artin/sourcegraph
1
0
Fork 0
mirror of https://github.com/sourcegraph/sourcegraph.git synced 2026-02-06 20:51:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

Move auth check helpers out of cmd/frontend (#42624)

Browse Source 
Those can be useful generally, so moving them out of the frontend command. Also, they're not specific to it. Looking at the updated imports, it has already been used outside, but created a bad dependency on frontend code.

Next step would be to take a generic DB type thus getting rid of the dependency on internal/database, so we can also use that package in there.
This commit is contained in:
Erik Seliger 2022-10-06 12:22:02 +02:00 committed by GitHub
parent c536a9d4f3
commit 01057ebf80
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
91 changed files with 398 additions and 384 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
cmd/frontend/backend/external_services.go
View File

@ -7,6 +7,7 @@ import (
"github.com/sourcegraph/log"
"github.com/sourcegraph/sourcegraph/internal/actor"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/database"
"github.com/sourcegraph/sourcegraph/internal/extsvc"
"github.com/sourcegraph/sourcegraph/internal/repoupdater/protocol"
@ -27,12 +28,12 @@ func CheckExternalServiceAccess(ctx context.Context, db database.DB, namespaceUs
return nil
}
if namespaceOrgID > 0 && CheckOrgAccess(ctx, db, namespaceOrgID) == nil {
if namespaceOrgID > 0 && auth.CheckOrgAccess(ctx, db, namespaceOrgID) == nil {
return nil
}
// Special case when external service has no owner
if namespaceUserID == 0 && namespaceOrgID == 0 && CheckCurrentUserIsSiteAdmin(ctx, db) == nil {
if namespaceUserID == 0 && namespaceOrgID == 0 && auth.CheckCurrentUserIsSiteAdmin(ctx, db) == nil {
return nil
}

6
cmd/frontend/backend/user_emails.go
View File

@ -7,9 +7,11 @@ import (
"net/url"
"github.com/sourcegraph/log"
"github.com/sourcegraph/sourcegraph/cmd/frontend/envvar"
"github.com/sourcegraph/sourcegraph/cmd/frontend/globals"
"github.com/sourcegraph/sourcegraph/cmd/frontend/internal/app/router"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/conf"
"github.com/sourcegraph/sourcegraph/internal/database"
"github.com/sourcegraph/sourcegraph/internal/errcode"
@ -85,13 +87,13 @@ func checkEmailAbuse(ctx context.Context, db database.DB, userID int32) (abused
func (userEmails) Add(ctx context.Context, logger log.Logger, db database.DB, userID int32, email string) error {
logger = logger.Scoped("UserEmails", "handles user emails")
// 🚨 SECURITY: Only the user and site admins can add an email address to a user.
if err := CheckSiteAdminOrSameUser(ctx, db, userID); err != nil {
if err := auth.CheckSiteAdminOrSameUser(ctx, db, userID); err != nil {
return err
}
// Prevent abuse (users adding emails of other people whom they want to annoy) with the
// following abuse prevention checks.
if isSiteAdmin := CheckCurrentUserIsSiteAdmin(ctx, db) == nil; !isSiteAdmin {
if isSiteAdmin := auth.CheckCurrentUserIsSiteAdmin(ctx, db) == nil; !isSiteAdmin {
abused, reason, err := checkEmailAbuse(ctx, db, userID)
if err != nil {
return err

4
cmd/frontend/enterprise/enterprise.go
View File

@ -5,10 +5,10 @@ import (
"fmt"
"net/http"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/envvar"
"github.com/sourcegraph/sourcegraph/cmd/frontend/graphqlbackend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/webhooks"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/conf"
"github.com/sourcegraph/sourcegraph/internal/database"
)
@ -127,7 +127,7 @@ func BatchChangesEnabledForUser(ctx context.Context, db database.DB) error {
return err
}
if conf.BatchChangesRestrictedToAdmins() && backend.CheckCurrentUserIsSiteAdmin(ctx, db) != nil {
if conf.BatchChangesRestrictedToAdmins() && auth.CheckCurrentUserIsSiteAdmin(ctx, db) != nil {
return ErrBatchChangesDisabledForUser{}
}
return nil

4
cmd/frontend/graphqlbackend/access_token.go
View File

@ -6,7 +6,7 @@ import (
"github.com/graph-gophers/graphql-go"
"github.com/graph-gophers/graphql-go/relay"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/database"
)
@ -34,7 +34,7 @@ func accessTokenByID(ctx context.Context, db database.DB, id graphql.ID) (*acces
return nil, err
}
// 🚨 SECURITY: Only the user (token owner) and site admins may retrieve the token.
if err := backend.CheckSiteAdminOrSameUser(ctx, db, accessToken.SubjectUserID); err != nil {
if err := auth.CheckSiteAdminOrSameUser(ctx, db, accessToken.SubjectUserID); err != nil {
return nil, err
}
return &accessTokenResolver{db: db, accessToken: *accessToken}, nil

14
cmd/frontend/graphqlbackend/access_tokens.go
View File

@ -8,10 +8,12 @@ import (
"github.com/graph-gophers/graphql-go"
"github.com/sourcegraph/log"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/envvar"
"github.com/sourcegraph/sourcegraph/cmd/frontend/graphqlbackend/graphqlutil"
"github.com/sourcegraph/sourcegraph/internal/actor"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/authz"
"github.com/sourcegraph/sourcegraph/internal/conf"
"github.com/sourcegraph/sourcegraph/internal/database"
@ -43,13 +45,13 @@ func (r *schemaResolver) CreateAccessToken(ctx context.Context, args *createAcce
// for themselves. A site admin should NOT be allowed to do this since they could
// then use the token to impersonate a user and gain access to their private
// code.
if err := backend.CheckSameUser(ctx, userID); err != nil {
if err := auth.CheckSameUser(ctx, userID); err != nil {
return nil, err
}
case conf.AccessTokensAdmin:
// 🚨 SECURITY: The site has opted in to only allow site admins to create access
// tokens. In this case, they can create a token for any user.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, errors.New("Access token creation has been restricted to admin users. Contact an admin user to create a new access token.")
}
case conf.AccessTokensNone:
@ -67,7 +69,7 @@ func (r *schemaResolver) CreateAccessToken(ctx context.Context, args *createAcce
hasUserAllScope = true
case authz.ScopeSiteAdminSudo:
// 🚨 SECURITY: Only site admins may create a token with the "site-admin:sudo" scope.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
} else if envvar.SourcegraphDotComMode() {
return nil, errors.Errorf("creation of access tokens with scope %q is disabled on Sourcegraph.com", authz.ScopeSiteAdminSudo)
@ -130,7 +132,7 @@ func (r *schemaResolver) DeleteAccessToken(ctx context.Context, args *deleteAcce
}
// 🚨 SECURITY: Only site admins and the user can delete a user's access token.
if err := backend.CheckSiteAdminOrSameUser(ctx, r.db, token.SubjectUserID); err != nil {
if err := auth.CheckSiteAdminOrSameUser(ctx, r.db, token.SubjectUserID); err != nil {
return nil, err
}
if err := r.db.AccessTokens().DeleteByID(ctx, token.ID); err != nil {
@ -166,7 +168,7 @@ func (r *siteResolver) AccessTokens(ctx context.Context, args *struct {
}) (*accessTokenConnectionResolver, error) {
// 🚨 SECURITY: Only site admins can list all access tokens. This is safe as the
// token values themselves are not stored in our database.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}
@ -179,7 +181,7 @@ func (r *UserResolver) AccessTokens(ctx context.Context, args *struct {
graphqlutil.ConnectionArgs
}) (*accessTokenConnectionResolver, error) {
// 🚨 SECURITY: Only site admins and the user can list a user's access tokens.
if err := backend.CheckSiteAdminOrSameUser(ctx, r.db, r.user.ID); err != nil {
if err := auth.CheckSiteAdminOrSameUser(ctx, r.db, r.user.ID); err != nil {
return nil, err
}

6
cmd/frontend/graphqlbackend/access_tokens_test.go
View File

@ -10,9 +10,9 @@ import (
gqlerrors "github.com/graph-gophers/graphql-go/errors"
"github.com/stretchr/testify/assert"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/envvar"
"github.com/sourcegraph/sourcegraph/internal/actor"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/authz"
"github.com/sourcegraph/sourcegraph/internal/conf"
"github.com/sourcegraph/sourcegraph/internal/database"
@ -101,7 +101,7 @@ func TestMutation_CreateAccessToken(t *testing.T) {
Scopes: []string{authz.ScopeUserAll, authz.ScopeSiteAdminSudo},
Note: "n",
})
if want := backend.ErrMustBeSiteAdmin; err != want {
if want := auth.ErrMustBeSiteAdmin; err != want {
t.Errorf("got err %v, want %v", err, want)
}
if result != nil {
@ -170,7 +170,7 @@ func TestMutation_CreateAccessToken(t *testing.T) {
{
Path: []any{"createAccessToken"},
Message: "must be authenticated as user with id 1",
ResolverError: &backend.InsufficientAuthorizationError{Message: fmt.Sprintf("must be authenticated as user with id %d", 1)},
ResolverError: &auth.InsufficientAuthorizationError{Message: fmt.Sprintf("must be authenticated as user with id %d", 1)},
},
},
},

6
cmd/frontend/graphqlbackend/event_logs.go
View File

@ -3,9 +3,9 @@ package graphqlbackend
import (
"context"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/envvar"
"github.com/sourcegraph/sourcegraph/cmd/frontend/graphqlbackend/graphqlutil"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/database"
)
@ -18,13 +18,13 @@ func (r *UserResolver) EventLogs(ctx context.Context, args *eventLogsArgs) (*use
// 🚨 SECURITY: Only the authenticated user can view their event logs on
// Sourcegraph.com.
if envvar.SourcegraphDotComMode() {
if err := backend.CheckSameUser(ctx, r.user.ID); err != nil {
if err := auth.CheckSameUser(ctx, r.user.ID); err != nil {
return nil, err
}
} else {
// 🚨 SECURITY: Only the authenticated user and site admins can view users'
// event logs.
if err := backend.CheckSiteAdminOrSameUser(ctx, r.db, r.user.ID); err != nil {
if err := auth.CheckSiteAdminOrSameUser(ctx, r.db, r.user.ID); err != nil {
return nil, err
}
}

6
cmd/frontend/graphqlbackend/execution_log_entry.go
View File

@ -3,7 +3,7 @@ package graphqlbackend
import (
"context"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/database"
"github.com/sourcegraph/sourcegraph/internal/workerutil"
)
@ -56,8 +56,8 @@ func (r *executionLogEntryResolver) DurationMilliseconds() *int32 {
func (r *executionLogEntryResolver) Out(ctx context.Context) (string, error) {
// 🚨 SECURITY: Only site admins can view executor log contents.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err != backend.ErrMustBeSiteAdmin {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err != auth.ErrMustBeSiteAdmin {
return "", err
}

6
cmd/frontend/graphqlbackend/executors.go
View File

@ -5,7 +5,7 @@ import (
"github.com/graph-gophers/graphql-go"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/conf"
"github.com/sourcegraph/sourcegraph/internal/database"
gql "github.com/sourcegraph/sourcegraph/internal/services/executors/transport/graphql"
@ -18,7 +18,7 @@ func (r *schemaResolver) Executors(ctx context.Context, args *struct {
After *string
}) (*gql.ExecutorPaginatedResolver, error) {
// 🚨 SECURITY: Only site-admins may view executor details
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}
@ -35,7 +35,7 @@ func (r *schemaResolver) AreExecutorsConfigured() bool {
}
func executorByID(ctx context.Context, db database.DB, gqlID graphql.ID, r *schemaResolver) (*gql.ExecutorResolver, error) {
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, db); err != nil {
return nil, err
}

8
cmd/frontend/graphqlbackend/external_account.go
View File

@ -6,8 +6,8 @@ import (
"github.com/graph-gophers/graphql-go"
"github.com/graph-gophers/graphql-go/relay"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/internal/actor"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/database"
"github.com/sourcegraph/sourcegraph/internal/extsvc"
)
@ -28,7 +28,7 @@ func externalAccountByID(ctx context.Context, db database.DB, id graphql.ID) (*e
}
// 🚨 SECURITY: Only the user and site admins should be able to see a user's external accounts.
if err := backend.CheckSiteAdminOrSameUser(ctx, db, account.UserID); err != nil {
if err := auth.CheckSiteAdminOrSameUser(ctx, db, account.UserID); err != nil {
return nil, err
}
@ -68,9 +68,9 @@ func (r *externalAccountResolver) AccountData(ctx context.Context) (*JSONValue,
// GitLab, but only site admins can view account data for all other types.
var err error
if r.account.ServiceType == extsvc.TypeGitHub || r.account.ServiceType == extsvc.TypeGitLab || r.account.ServiceType == extsvc.TypeGitHubApp {
err = backend.CheckSiteAdminOrSameUser(ctx, r.db, actor.FromContext(ctx).UID)
err = auth.CheckSiteAdminOrSameUser(ctx, r.db, actor.FromContext(ctx).UID)
} else {
err = backend.CheckUserIsSiteAdmin(ctx, r.db, actor.FromContext(ctx).UID)
err = auth.CheckUserIsSiteAdmin(ctx, r.db, actor.FromContext(ctx).UID)
}
if err != nil {
return nil, err

8
cmd/frontend/graphqlbackend/external_accounts.go
View File

@ -7,8 +7,8 @@ import (
"github.com/graph-gophers/graphql-go"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/graphqlbackend/graphqlutil"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/database"
"github.com/sourcegraph/sourcegraph/internal/extsvc"
)
@ -21,7 +21,7 @@ func (r *siteResolver) ExternalAccounts(ctx context.Context, args *struct {
ClientID *string
}) (*externalAccountConnectionResolver, error) {
// 🚨 SECURITY: Only site admins can list all external accounts.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}
@ -50,7 +50,7 @@ func (r *UserResolver) ExternalAccounts(ctx context.Context, args *struct {
graphqlutil.ConnectionArgs
}) (*externalAccountConnectionResolver, error) {
// 🚨 SECURITY: Only site admins and the user can list a user's external accounts.
if err := backend.CheckSiteAdminOrSameUser(ctx, r.db, r.user.ID); err != nil {
if err := auth.CheckSiteAdminOrSameUser(ctx, r.db, r.user.ID); err != nil {
return nil, err
}
@ -128,7 +128,7 @@ func (r *schemaResolver) DeleteExternalAccount(ctx context.Context, args *struct
}
// 🚨 SECURITY: Only the user and site admins should be able to see a user's external accounts.
if err := backend.CheckSiteAdminOrSameUser(ctx, r.db, account.UserID); err != nil {
if err := auth.CheckSiteAdminOrSameUser(ctx, r.db, account.UserID); err != nil {
return nil, err
}

3
cmd/frontend/graphqlbackend/external_service.go
View File

@ -13,6 +13,7 @@ import (
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/graphqlbackend/graphqlutil"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/conf"
"github.com/sourcegraph/sourcegraph/internal/database"
"github.com/sourcegraph/sourcegraph/internal/errcode"
@ -298,7 +299,7 @@ func unmarshalExternalServiceSyncJobID(id graphql.ID) (jobID int64, err error) {
func externalServiceSyncJobByID(ctx context.Context, db database.DB, gqlID graphql.ID) (Node, error) {
// Site-admin only for now.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, db); err != nil {
return nil, err
}

7
cmd/frontend/graphqlbackend/external_services.go
View File

@ -20,6 +20,7 @@ import (
"github.com/sourcegraph/sourcegraph/cmd/frontend/envvar"
"github.com/sourcegraph/sourcegraph/cmd/frontend/graphqlbackend/graphqlutil"
"github.com/sourcegraph/sourcegraph/internal/actor"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/conf"
"github.com/sourcegraph/sourcegraph/internal/database"
"github.com/sourcegraph/sourcegraph/internal/env"
@ -78,7 +79,7 @@ func (r *schemaResolver) AddExternalService(ctx context.Context, args *addExtern
if err = backend.CheckOrgExternalServices(ctx, r.db, namespaceOrgID); err != nil {
return nil, err
}
if err = backend.CheckOrgAccess(ctx, r.db, namespaceOrgID); err != nil {
if err = auth.CheckOrgAccess(ctx, r.db, namespaceOrgID); err != nil {
err = errors.New("the authenticated user does not belong to the organization requested")
return nil, err
}
@ -92,8 +93,8 @@ func (r *schemaResolver) AddExternalService(ctx context.Context, args *addExtern
}
}
} else if backend.CheckCurrentUserIsSiteAdmin(ctx, r.db) != nil {
err = backend.ErrMustBeSiteAdmin
} else if auth.CheckCurrentUserIsSiteAdmin(ctx, r.db) != nil {
err = auth.ErrMustBeSiteAdmin
return nil, err
}

3
cmd/frontend/graphqlbackend/external_services_test.go
View File

@ -19,6 +19,7 @@ import (
"github.com/sourcegraph/sourcegraph/cmd/frontend/envvar"
"github.com/sourcegraph/sourcegraph/cmd/frontend/graphqlbackend/graphqlutil"
"github.com/sourcegraph/sourcegraph/internal/actor"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/conf"
"github.com/sourcegraph/sourcegraph/internal/database"
"github.com/sourcegraph/sourcegraph/internal/extsvc"
@ -41,7 +42,7 @@ func TestAddExternalService(t *testing.T) {
ctx := actor.WithActor(context.Background(), &actor.Actor{UID: 1})
result, err := newSchemaResolver(db).AddExternalService(ctx, &addExternalServiceArgs{})
if want := backend.ErrMustBeSiteAdmin; err != want {
if want := auth.ErrMustBeSiteAdmin; err != want {
t.Errorf("err: want %q but got %q", want, err)
}
if result != nil {

20
cmd/frontend/graphqlbackend/feature_flags.go
View File

@ -6,8 +6,8 @@ import (
"github.com/graph-gophers/graphql-go"
"github.com/graph-gophers/graphql-go/relay"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/internal/actor"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/database"
"github.com/sourcegraph/sourcegraph/internal/featureflag"
"github.com/sourcegraph/sourcegraph/lib/errors"
@ -158,7 +158,7 @@ func (r *schemaResolver) OrganizationFeatureFlagValue(ctx context.Context, args
return false, err
}
// same behavior as if the flag does not exist
if err := backend.CheckOrgAccess(ctx, r.db, org); err != nil {
if err := auth.CheckOrgAccess(ctx, r.db, org); err != nil {
return false, nil
}
@ -187,7 +187,7 @@ func (r *schemaResolver) OrganizationFeatureFlagOverrides(ctx context.Context) (
func (r *schemaResolver) FeatureFlag(ctx context.Context, args struct {
Name string
}) (*FeatureFlagResolver, error) {
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}
@ -200,7 +200,7 @@ func (r *schemaResolver) FeatureFlag(ctx context.Context, args struct {
}
func (r *schemaResolver) FeatureFlags(ctx context.Context) ([]*FeatureFlagResolver, error) {
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}
flags, err := r.db.FeatureFlags().GetFeatureFlags(ctx)
@ -223,7 +223,7 @@ func (r *schemaResolver) CreateFeatureFlag(ctx context.Context, args struct {
Value *bool
RolloutBasisPoints *int32
}) (*FeatureFlagResolver, error) {
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}
@ -245,7 +245,7 @@ func (r *schemaResolver) CreateFeatureFlag(ctx context.Context, args struct {
func (r *schemaResolver) DeleteFeatureFlag(ctx context.Context, args struct {
Name string
}) (*EmptyResponse, error) {
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}
return &EmptyResponse{}, r.db.FeatureFlags().DeleteFeatureFlag(ctx, args.Name)
@ -256,7 +256,7 @@ func (r *schemaResolver) UpdateFeatureFlag(ctx context.Context, args struct {
Value *bool
RolloutBasisPoints *int32
}) (*FeatureFlagResolver, error) {
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}
ff := &featureflag.FeatureFlag{Name: args.Name}
@ -277,7 +277,7 @@ func (r *schemaResolver) CreateFeatureFlagOverride(ctx context.Context, args str
FlagName string
Value bool
}) (*FeatureFlagOverrideResolver, error) {
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}
@ -303,7 +303,7 @@ func (r *schemaResolver) CreateFeatureFlagOverride(ctx context.Context, args str
func (r *schemaResolver) DeleteFeatureFlagOverride(ctx context.Context, args struct {
ID graphql.ID
}) (*EmptyResponse, error) {
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}
spec, err := unmarshalOverrideID(args.ID)
@ -317,7 +317,7 @@ func (r *schemaResolver) UpdateFeatureFlagOverride(ctx context.Context, args str
ID graphql.ID
Value bool
}) (*FeatureFlagOverrideResolver, error) {
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}
spec, err := unmarshalOverrideID(args.ID)

9
cmd/frontend/graphqlbackend/graphqlbackend.go
View File

@ -23,6 +23,7 @@ import (
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/internal/actor"
"github.com/sourcegraph/sourcegraph/internal/api"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/cloneurls"
"github.com/sourcegraph/sourcegraph/internal/conf"
"github.com/sourcegraph/sourcegraph/internal/database"
@ -614,7 +615,7 @@ func (r *schemaResolver) RecloneRepository(ctx context.Context, args *struct {
}
// 🚨 SECURITY: Only site admins can reclone repositories.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}
@ -639,7 +640,7 @@ func (r *schemaResolver) DeleteRepositoryFromDisk(ctx context.Context, args *str
return nil, err
}
// 🚨 SECURITY: Only site admins can delete repositories from disk.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}
@ -773,13 +774,13 @@ func (r *schemaResolver) AffiliatedRepositories(ctx context.Context, args *struc
}
if userID > 0 {
// 🚨 SECURITY: Make sure the user is the same user being requested
if err := backend.CheckSameUser(ctx, userID); err != nil {
if err := auth.CheckSameUser(ctx, userID); err != nil {
return nil, err
}
}
if orgID > 0 {
// 🚨 SECURITY: Make sure the user can access the organization
if err := backend.CheckOrgAccess(ctx, r.db, orgID); err != nil {
if err := auth.CheckOrgAccess(ctx, r.db, orgID); err != nil {
return nil, err
}
}

3
cmd/frontend/graphqlbackend/graphqlbackend_test.go
View File

@ -25,6 +25,7 @@ import (
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/internal/actor"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/conf"
"github.com/sourcegraph/sourcegraph/internal/conf/conftypes"
"github.com/sourcegraph/sourcegraph/internal/database"
@ -449,7 +450,7 @@ func TestAffiliatedRepositories(t *testing.T) {
{
Path: []any{"affiliatedRepositories"},
Message: "must be authenticated as user with id 1",
ResolverError: &backend.InsufficientAuthorizationError{Message: fmt.Sprintf("must be authenticated as user with id %d", 1)},
ResolverError: &auth.InsufficientAuthorizationError{Message: fmt.Sprintf("must be authenticated as user with id %d", 1)},
},
},
},

4
cmd/frontend/graphqlbackend/observability.go
View File

@ -7,7 +7,7 @@ import (
"github.com/prometheus/client_golang/prometheus"
"github.com/prometheus/client_golang/prometheus/promauto"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/lib/errors"
)
@ -25,7 +25,7 @@ func (r *schemaResolver) TriggerObservabilityTestAlert(ctx context.Context, args
Level string
}) (*EmptyResponse, error) {
// 🚨 SECURITY: Do not allow arbitrary users to set off alerts.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}

8
cmd/frontend/graphqlbackend/oobmigrations.go
View File

@ -6,14 +6,14 @@ import (
"github.com/graph-gophers/graphql-go"
"github.com/graph-gophers/graphql-go/relay"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/oobmigration"
)
// OutOfBandMigrationByID resolves a single out-of-band migration by its identifier.
func (r *schemaResolver) OutOfBandMigrationByID(ctx context.Context, id graphql.ID) (*outOfBandMigrationResolver, error) {
// 🚨 SECURITY: Only site admins may view out-of-band migrations
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}
@ -33,7 +33,7 @@ func (r *schemaResolver) OutOfBandMigrationByID(ctx context.Context, id graphql.
// OutOfBandMigrations resolves all registered single out-of-band migrations.
func (r *schemaResolver) OutOfBandMigrations(ctx context.Context) ([]*outOfBandMigrationResolver, error) {
// 🚨 SECURITY: Only site admins may view out-of-band migrations
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}
@ -56,7 +56,7 @@ func (r *schemaResolver) SetMigrationDirection(ctx context.Context, args *struct
ApplyReverse bool
}) (*EmptyResponse, error) {
// 🚨 SECURITY: Only site admins may modify out-of-band migrations
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}

28
cmd/frontend/graphqlbackend/org.go
View File

@ -8,11 +8,11 @@ import (
"github.com/graph-gophers/graphql-go/relay"
"github.com/inconshreveable/log15"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/envvar"
"github.com/sourcegraph/sourcegraph/cmd/frontend/internal/suspiciousnames"
"github.com/sourcegraph/sourcegraph/internal/actor"
"github.com/sourcegraph/sourcegraph/internal/api"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/database"
"github.com/sourcegraph/sourcegraph/internal/errcode"
"github.com/sourcegraph/sourcegraph/internal/extsvc"
@ -29,7 +29,7 @@ func (r *schemaResolver) Organization(ctx context.Context, args struct{ Name str
// 🚨 SECURITY: Only org members can get org details on Cloud
if envvar.SourcegraphDotComMode() {
hasAccess := func() error {
if backend.CheckOrgAccess(ctx, r.db, org.ID) == nil {
if auth.CheckOrgAccess(ctx, r.db, org.ID) == nil {
return nil
}
@ -46,7 +46,7 @@ func (r *schemaResolver) Organization(ctx context.Context, args struct{ Name str
}
if err := hasAccess(); err != nil {
// site admin can access org ID
if backend.CheckCurrentUserIsSiteAdmin(ctx, r.db) == nil {
if auth.CheckCurrentUserIsSiteAdmin(ctx, r.db) == nil {
onlyOrgID := &types.Org{ID: org.ID}
return &OrgResolver{db: r.db, org: onlyOrgID}, nil
}
@ -80,7 +80,7 @@ func orgByIDInt32WithForcedAccess(ctx context.Context, db database.DB, orgID int
// 🚨 SECURITY: Only org members can get org details on Cloud
// And all invited users by email
if !forceAccess && envvar.SourcegraphDotComMode() {
err := backend.CheckOrgAccess(ctx, db, orgID)
err := auth.CheckOrgAccess(ctx, db, orgID)
if err != nil {
hasAccess := false
// allow invited user to view org details
@ -141,8 +141,8 @@ func (o *OrgResolver) CreatedAt() DateTime { return DateTime{Time: o.org.Created
func (o *OrgResolver) Members(ctx context.Context) (*staticUserConnectionResolver, error) {
// 🚨 SECURITY: Only org members can list other org members.
if err := backend.CheckOrgAccessOrSiteAdmin(ctx, o.db, o.org.ID); err != nil {
if err == backend.ErrNotAnOrgMember {
if err := auth.CheckOrgAccessOrSiteAdmin(ctx, o.db, o.org.ID); err != nil {
if err == auth.ErrNotAnOrgMember {
return nil, errors.New("must be a member of this organization to view members")
}
return nil, err
@ -170,7 +170,7 @@ func (o *OrgResolver) settingsSubject() api.SettingsSubject {
func (o *OrgResolver) LatestSettings(ctx context.Context) (*settingsResolver, error) {
// 🚨 SECURITY: Only organization members and site admins (not on cloud) may access the settings,
// because they may contain secrets or other sensitive data.
if err := backend.CheckOrgAccessOrSiteAdmin(ctx, o.db, o.org.ID); err != nil {
if err := auth.CheckOrgAccessOrSiteAdmin(ctx, o.db, o.org.ID); err != nil {
return nil, err
}
@ -210,7 +210,7 @@ func (o *OrgResolver) ViewerPendingInvitation(ctx context.Context) (*organizatio
}
func (o *OrgResolver) ViewerCanAdminister(ctx context.Context) (bool, error) {
if err := backend.CheckOrgAccessOrSiteAdmin(ctx, o.db, o.org.ID); err == backend.ErrNotAuthenticated || err == backend.ErrNotAnOrgMember {
if err := auth.CheckOrgAccessOrSiteAdmin(ctx, o.db, o.org.ID); err == auth.ErrNotAuthenticated || err == auth.ErrNotAnOrgMember {
return false, nil
} else if err != nil {
return false, err
@ -329,7 +329,7 @@ func (r *schemaResolver) UpdateOrganization(ctx context.Context, args *struct {
// 🚨 SECURITY: Check that the current user is a member
// of the org that is being modified.
if err := backend.CheckOrgAccessOrSiteAdmin(ctx, r.db, orgID); err != nil {
if err := auth.CheckOrgAccessOrSiteAdmin(ctx, r.db, orgID); err != nil {
return nil, err
}
@ -356,7 +356,7 @@ func (r *schemaResolver) RemoveUserFromOrganization(ctx context.Context, args *s
// 🚨 SECURITY: Check that the current user is a member of the org that is being modified, or a
// site admin.
if err := backend.CheckOrgAccessOrSiteAdmin(ctx, r.db, orgID); err != nil {
if err := auth.CheckOrgAccessOrSiteAdmin(ctx, r.db, orgID); err != nil {
return nil, err
}
memberCount, err := r.db.OrgMembers().MemberCount(ctx, orgID)
@ -382,10 +382,10 @@ func (r *schemaResolver) RemoveUserFromOrganization(ctx context.Context, args *s
}
func (r *schemaResolver) siteAdminSelfRemoving(ctx context.Context, userID int32) bool {
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return false
}
if err := backend.CheckSameUser(ctx, userID); err != nil {
if err := auth.CheckSameUser(ctx, userID); err != nil {
return false
}
return true
@ -403,13 +403,13 @@ func (r *schemaResolver) AddUserToOrganization(ctx context.Context, args *struct
// 🚨 SECURITY: Do not allow direct add on Cloud unless the site admin is a member of the org
if envvar.SourcegraphDotComMode() {
if err := backend.CheckOrgAccess(ctx, r.db, orgID); err != nil {
if err := auth.CheckOrgAccess(ctx, r.db, orgID); err != nil {
return nil, errors.Errorf("Must be a member of the organization to add members", err)
}
}
// 🚨 SECURITY: Must be a site admin to immediately add a user to an organization (bypassing the
// invitation step).
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}

10
cmd/frontend/graphqlbackend/org_invitations.go
View File

@ -15,10 +15,10 @@ import (
"github.com/graph-gophers/graphql-go/relay"
"github.com/inconshreveable/log15"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/envvar"
"github.com/sourcegraph/sourcegraph/cmd/frontend/globals"
"github.com/sourcegraph/sourcegraph/internal/actor"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/conf"
"github.com/sourcegraph/sourcegraph/internal/database"
"github.com/sourcegraph/sourcegraph/internal/errcode"
@ -127,7 +127,7 @@ func (r *schemaResolver) PendingInvitations(ctx context.Context, args *struct {
}
// 🚨 SECURITY: Check that the current user is a member of the org that we get the invitations for
if err := backend.CheckOrgAccess(ctx, r.db, orgID); err != nil {
if err := auth.CheckOrgAccess(ctx, r.db, orgID); err != nil {
return nil, err
}
@ -213,7 +213,7 @@ func (r *schemaResolver) InviteUserToOrganization(ctx context.Context, args *str
}
// 🚨 SECURITY: Check that the current user is a member of the org that the user is being
// invited to.
if err := backend.CheckOrgAccessOrSiteAdmin(ctx, r.db, orgID); err != nil {
if err := auth.CheckOrgAccessOrSiteAdmin(ctx, r.db, orgID); err != nil {
return nil, err
}
// check org has feature flag for email invites enabled, we can ignore errors here as flag value would be false
@ -371,7 +371,7 @@ func (r *schemaResolver) ResendOrganizationInvitationNotification(ctx context.Co
}
// 🚨 SECURITY: Check that the current user is a member of the org that the invite is for.
if err := backend.CheckOrgAccessOrSiteAdmin(ctx, r.db, orgInvitation.OrgID); err != nil {
if err := auth.CheckOrgAccessOrSiteAdmin(ctx, r.db, orgInvitation.OrgID); err != nil {
return nil, err
}
@ -440,7 +440,7 @@ func (r *schemaResolver) RevokeOrganizationInvitation(ctx context.Context, args
}
// 🚨 SECURITY: Check that the current user is a member of the org that the invite is for.
if err := backend.CheckOrgAccessOrSiteAdmin(ctx, r.db, orgInvitation.OrgID); err != nil {
if err := auth.CheckOrgAccessOrSiteAdmin(ctx, r.db, orgInvitation.OrgID); err != nil {
return nil, err
}

4
cmd/frontend/graphqlbackend/org_members.go
View File

@ -5,9 +5,9 @@ import (
"github.com/graph-gophers/graphql-go"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/graphqlbackend/graphqlutil"
"github.com/sourcegraph/sourcegraph/internal/actor"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/database"
"github.com/sourcegraph/sourcegraph/internal/types"
"github.com/sourcegraph/sourcegraph/lib/errors"
@ -16,7 +16,7 @@ import (
func (r *UserResolver) OrganizationMemberships(ctx context.Context) (*organizationMembershipConnectionResolver, error) {
// 🚨 SECURITY: Only the user and admins are allowed to access the user's
// organisation memberships.
if err := backend.CheckSiteAdminOrSameUser(ctx, r.db, r.user.ID); err != nil {
if err := auth.CheckSiteAdminOrSameUser(ctx, r.db, r.user.ID); err != nil {
return nil, err
}
memberships, err := r.db.OrgMembers().GetByUserID(ctx, r.user.ID)

6
cmd/frontend/graphqlbackend/orgs.go
View File

@ -3,9 +3,9 @@ package graphqlbackend
import (
"context"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/envvar"
"github.com/sourcegraph/sourcegraph/cmd/frontend/graphqlbackend/graphqlutil"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/database"
"github.com/sourcegraph/sourcegraph/lib/errors"
)
@ -34,7 +34,7 @@ func (r *orgConnectionResolver) Nodes(ctx context.Context) ([]*OrgResolver, erro
}
// 🚨 SECURITY: Only site admins can list organisations.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}
@ -55,7 +55,7 @@ func (r *orgConnectionResolver) Nodes(ctx context.Context) ([]*OrgResolver, erro
func (r *orgConnectionResolver) TotalCount(ctx context.Context) (int32, error) {
// 🚨 SECURITY: Only site admins can count organisations.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return 0, err
}

9
cmd/frontend/graphqlbackend/repositories.go
View File

@ -14,6 +14,7 @@ import (
"github.com/sourcegraph/sourcegraph/cmd/frontend/envvar"
"github.com/sourcegraph/sourcegraph/cmd/frontend/graphqlbackend/graphqlutil"
"github.com/sourcegraph/sourcegraph/internal/api"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/conf"
"github.com/sourcegraph/sourcegraph/internal/database"
"github.com/sourcegraph/sourcegraph/internal/gitserver"
@ -138,7 +139,7 @@ func (r *repositoryConnectionResolver) compute(ctx context.Context) ([]*types.Re
if envvar.SourcegraphDotComMode() {
// 🚨 SECURITY: Don't allow non-admins to perform huge queries on Sourcegraph.com.
if isSiteAdmin := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db) == nil; !isSiteAdmin {
if isSiteAdmin := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db) == nil; !isSiteAdmin {
if opt2.LimitOffset == nil {
opt2.LimitOffset = &database.LimitOffset{Limit: 1000}
}
@ -234,17 +235,17 @@ func (r *repositoryConnectionResolver) Nodes(ctx context.Context) ([]*Repository
func (r *repositoryConnectionResolver) TotalCount(ctx context.Context, args *TotalCountArgs) (countptr *int32, err error) {
if r.opt.UserID != 0 {
// 🚨 SECURITY: If filtering by user, restrict to that user
if err := backend.CheckSameUser(ctx, r.opt.UserID); err != nil {
if err := auth.CheckSameUser(ctx, r.opt.UserID); err != nil {
return nil, err
}
} else if r.opt.OrgID != 0 {
if err := backend.CheckOrgAccess(ctx, r.db, r.opt.OrgID); err != nil {
if err := auth.CheckOrgAccess(ctx, r.db, r.opt.OrgID); err != nil {
return nil, err
}
} else {
// 🚨 SECURITY: Only site admins can list all repos, because a total repository
// count does not respect repository permissions.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}
}

6
cmd/frontend/graphqlbackend/repositories_test.go
View File

@ -11,8 +11,8 @@ import (
"github.com/sourcegraph/log/logtest"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/internal/actor"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/database"
"github.com/sourcegraph/sourcegraph/internal/database/dbtest"
"github.com/sourcegraph/sourcegraph/internal/types"
@ -88,8 +88,8 @@ func TestRepositories(t *testing.T) {
ExpectedErrors: []*gqlerrors.QueryError{
{
Path: []any{"repositories", "totalCount"},
Message: backend.ErrMustBeSiteAdmin.Error(),
ResolverError: backend.ErrMustBeSiteAdmin,
Message: auth.ErrMustBeSiteAdmin.Error(),
ResolverError: auth.ErrMustBeSiteAdmin,
},
},
},

15
cmd/frontend/graphqlbackend/repository.go
View File

@ -15,6 +15,7 @@ import (
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/graphqlbackend/externallink"
"github.com/sourcegraph/sourcegraph/internal/api"
"github.com/sourcegraph/sourcegraph/internal/auth"
autoindex "github.com/sourcegraph/sourcegraph/internal/codeintel/autoindexing/transport/graphql"
policies "github.com/sourcegraph/sourcegraph/internal/codeintel/policies/transport/graphql"
sharedresolvers "github.com/sourcegraph/sourcegraph/internal/codeintel/shared/resolvers"
@ -139,8 +140,8 @@ func (r *RepositoryResolver) Description(ctx context.Context) (string, error) {
}
func (r *RepositoryResolver) ViewerCanAdminister(ctx context.Context) (bool, error) {
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err == backend.ErrMustBeSiteAdmin || err == backend.ErrNotAuthenticated {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err == auth.ErrMustBeSiteAdmin || err == auth.ErrNotAuthenticated {
return false, nil // not an error
}
return false, err
@ -153,8 +154,8 @@ func (r *RepositoryResolver) CloneInProgress(ctx context.Context) (bool, error)
}
func (r *RepositoryResolver) DiskSizeBytes(ctx context.Context) (*BigInt, error) {
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err == backend.ErrMustBeSiteAdmin || err == backend.ErrNotAuthenticated {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err == auth.ErrMustBeSiteAdmin || err == auth.ErrNotAuthenticated {
return nil, nil // not an error
}
return nil, err
@ -620,7 +621,7 @@ func (r *schemaResolver) AddRepoKeyValuePair(ctx context.Context, args struct {
Value *string
},
) (*EmptyResponse, error) {
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return &EmptyResponse{}, err
}
@ -638,7 +639,7 @@ func (r *schemaResolver) UpdateRepoKeyValuePair(ctx context.Context, args struct
Value *string
},
) (*EmptyResponse, error) {
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return &EmptyResponse{}, err
}
@ -656,7 +657,7 @@ func (r *schemaResolver) DeleteRepoKeyValuePair(ctx context.Context, args struct
Key string
},
) (*EmptyResponse, error) {
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return &EmptyResponse{}, err
}

4
cmd/frontend/graphqlbackend/repository_external.go
View File

@ -3,8 +3,8 @@ package graphqlbackend
import (
"context"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/graphqlbackend/graphqlutil"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/database"
"github.com/sourcegraph/sourcegraph/internal/types"
)
@ -46,7 +46,7 @@ func (r *RepositoryResolver) ExternalServices(ctx context.Context, args *struct
graphqlutil.ConnectionArgs
}) (*computedExternalServiceConnectionResolver, error) {
// 🚨 SECURITY: Only site admins may read external services (they have secrets).
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}

9
cmd/frontend/graphqlbackend/repository_mirror.go
View File

@ -10,6 +10,7 @@ import (
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/internal/api"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/database"
"github.com/sourcegraph/sourcegraph/internal/gitserver"
"github.com/sourcegraph/sourcegraph/internal/lazyregexp"
@ -62,7 +63,7 @@ var nonSCPURLRegex = lazyregexp.New(`^(git\+)?(https?|ssh|rsync|file|git|perforc
func (r *repositoryMirrorInfoResolver) RemoteURL(ctx context.Context) (string, error) {
// 🚨 SECURITY: The remote URL might contain secret credentials in the URL userinfo, so
// only allow site admins to see it.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return "", err
}
@ -170,7 +171,7 @@ func (r *repositoryMirrorInfoResolver) ByteSize(ctx context.Context) (BigInt, er
func (r *repositoryMirrorInfoResolver) Shard(ctx context.Context) (*string, error) {
// 🚨 SECURITY: This is a query that reveals internal details of the
// instance that only the admin should be able to see.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}
@ -246,7 +247,7 @@ func (r *schemaResolver) CheckMirrorRepositoryConnection(ctx context.Context, ar
}) (*checkMirrorRepositoryConnectionResult, error) {
// 🚨 SECURITY: This is an expensive operation and the errors may contain secrets,
// so only site admins may run it.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}
@ -293,7 +294,7 @@ func (r *schemaResolver) UpdateMirrorRepository(ctx context.Context, args *struc
Repository graphql.ID
}) (*EmptyResponse, error) {
// 🚨 SECURITY: There is no reason why non-site-admins would need to run this operation.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}

4
cmd/frontend/graphqlbackend/repository_stats.go
View File

@ -4,7 +4,7 @@ import (
"context"
"sync"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/conf"
"github.com/sourcegraph/sourcegraph/internal/database"
"github.com/sourcegraph/sourcegraph/internal/gitserver"
@ -161,7 +161,7 @@ func (r *repositoryStatsResolver) computeRepoStatistics(ctx context.Context) (da
func (r *schemaResolver) RepositoryStats(ctx context.Context) (*repositoryStatsResolver, error) {
// 🚨 SECURITY: Only site admins may query repository statistics for the site.
db := r.db
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, db); err != nil {
return nil, err
}

18
cmd/frontend/graphqlbackend/saved_searches.go
View File

@ -6,8 +6,8 @@ import (
"github.com/graph-gophers/graphql-go"
"github.com/graph-gophers/graphql-go/relay"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/internal/actor"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/database"
"github.com/sourcegraph/sourcegraph/internal/lazyregexp"
"github.com/sourcegraph/sourcegraph/internal/types"
@ -43,12 +43,12 @@ func (r *schemaResolver) savedSearchByID(ctx context.Context, id graphql.ID) (*s
// search.
if ss.Config.UserID != nil {
if *ss.Config.UserID != actor.FromContext(ctx).UID {
return nil, &backend.InsufficientAuthorizationError{
return nil, &auth.InsufficientAuthorizationError{
Message: "current user has insufficient privileges to view saved search",
}
}
} else if ss.Config.OrgID != nil {
if err := backend.CheckOrgAccess(ctx, r.db, *ss.Config.OrgID); err != nil {
if err := auth.CheckOrgAccess(ctx, r.db, *ss.Config.OrgID); err != nil {
return nil, err
}
} else {
@ -152,7 +152,7 @@ func (r *schemaResolver) CreateSavedSearch(ctx context.Context, args *struct {
return nil, err
}
userID = &u
if err := backend.CheckSiteAdminOrSameUser(ctx, r.db, u); err != nil {
if err := auth.CheckSiteAdminOrSameUser(ctx, r.db, u); err != nil {
return nil, err
}
} else if args.OrgID != nil {
@ -161,7 +161,7 @@ func (r *schemaResolver) CreateSavedSearch(ctx context.Context, args *struct {
return nil, err
}
orgID = &o
if err := backend.CheckOrgAccessOrSiteAdmin(ctx, r.db, o); err != nil {
if err := auth.CheckOrgAccessOrSiteAdmin(ctx, r.db, o); err != nil {
return nil, err
}
} else {
@ -208,11 +208,11 @@ func (r *schemaResolver) UpdateSavedSearch(ctx context.Context, args *struct {
// 🚨 SECURITY: Make sure the current user has permission to update a saved search for the specified user or org.
if old.Config.UserID != nil {
if err := backend.CheckSiteAdminOrSameUser(ctx, r.db, *old.Config.UserID); err != nil {
if err := auth.CheckSiteAdminOrSameUser(ctx, r.db, *old.Config.UserID); err != nil {
return nil, err
}
} else if old.Config.OrgID != nil {
if err := backend.CheckOrgAccessOrSiteAdmin(ctx, r.db, *old.Config.OrgID); err != nil {
if err := auth.CheckOrgAccessOrSiteAdmin(ctx, r.db, *old.Config.OrgID); err != nil {
return nil, err
}
} else {
@ -252,11 +252,11 @@ func (r *schemaResolver) DeleteSavedSearch(ctx context.Context, args *struct {
}
// 🚨 SECURITY: Make sure the current user has permission to delete a saved search for the specified user or org.
if ss.Config.UserID != nil {
if err := backend.CheckSiteAdminOrSameUser(ctx, r.db, *ss.Config.UserID); err != nil {
if err := auth.CheckSiteAdminOrSameUser(ctx, r.db, *ss.Config.UserID); err != nil {
return nil, err
}
} else if ss.Config.OrgID != nil {
if err := backend.CheckOrgAccessOrSiteAdmin(ctx, r.db, *ss.Config.OrgID); err != nil {
if err := auth.CheckOrgAccessOrSiteAdmin(ctx, r.db, *ss.Config.OrgID); err != nil {
return nil, err
}
} else {

6
cmd/frontend/graphqlbackend/saved_searches_test.go
View File

@ -9,9 +9,9 @@ import (
"github.com/graph-gophers/graphql-go"
"github.com/stretchr/testify/require"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/internal/actor"
"github.com/sourcegraph/sourcegraph/internal/api"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/database"
"github.com/sourcegraph/sourcegraph/internal/types"
)
@ -299,7 +299,7 @@ func TestUpdateSavedSearchPermissions(t *testing.T) {
}, {
execUser: user1,
ssUserID: &user2.ID,
errIs: &backend.InsufficientAuthorizationError{},
errIs: &auth.InsufficientAuthorizationError{},
}, {
execUser: user1,
ssOrgID: &org1.ID,
@ -307,7 +307,7 @@ func TestUpdateSavedSearchPermissions(t *testing.T) {
}, {
execUser: user1,
ssOrgID: &org2.ID,
errIs: backend.ErrNotAnOrgMember,
errIs: auth.ErrNotAnOrgMember,
}, {
execUser: admin,
ssOrgID: &user1.ID,

4
cmd/frontend/graphqlbackend/send_test_email.go
View File

@ -4,14 +4,14 @@ import (
"context"
"fmt"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/txemail"
"github.com/sourcegraph/sourcegraph/internal/txemail/txtypes"
)
func (r *schemaResolver) SendTestEmail(ctx context.Context, args struct{ To string }) (string, error) {
// 🚨 SECURITY: Only site admins can send test emails.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return "", err
}

8
cmd/frontend/graphqlbackend/settings_subject.go
View File

@ -5,9 +5,9 @@ import (
"github.com/graph-gophers/graphql-go"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/envvar"
"github.com/sourcegraph/sourcegraph/internal/api"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/jsonc"
"github.com/sourcegraph/sourcegraph/lib/errors"
)
@ -42,12 +42,12 @@ func settingsSubjectForNode(ctx context.Context, n Node) (*settingsSubject, erro
// 🚨 SECURITY: Only the authenticated user can view their settings on
// Sourcegraph.com.
if envvar.SourcegraphDotComMode() {
if err := backend.CheckSameUser(ctx, s.user.ID); err != nil {
if err := auth.CheckSameUser(ctx, s.user.ID); err != nil {
return nil, err
}
} else {
// 🚨 SECURITY: Only the user and site admins are allowed to view the user's settings.
if err := backend.CheckSiteAdminOrSameUser(ctx, s.db, s.user.ID); err != nil {
if err := auth.CheckSiteAdminOrSameUser(ctx, s.db, s.user.ID); err != nil {
return nil, err
}
}
@ -55,7 +55,7 @@ func settingsSubjectForNode(ctx context.Context, n Node) (*settingsSubject, erro
case *OrgResolver:
// 🚨 SECURITY: Check that the current user is a member of the org.
if err := backend.CheckOrgAccessOrSiteAdmin(ctx, s.db, s.org.ID); err != nil {
if err := auth.CheckOrgAccessOrSiteAdmin(ctx, s.db, s.org.ID); err != nil {
return nil, err
}
return &settingsSubject{org: s}, nil

14
cmd/frontend/graphqlbackend/site.go
View File

@ -9,9 +9,9 @@ import (
"github.com/graph-gophers/graphql-go"
"github.com/graph-gophers/graphql-go/relay"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/internal/siteid"
"github.com/sourcegraph/sourcegraph/internal/api"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/conf"
"github.com/sourcegraph/sourcegraph/internal/database"
"github.com/sourcegraph/sourcegraph/internal/env"
@ -61,14 +61,14 @@ func (r *siteResolver) SiteID() string { return siteid.Get() }
func (r *siteResolver) Configuration(ctx context.Context) (*siteConfigurationResolver, error) {
// 🚨 SECURITY: The site configuration contains secret tokens and credentials,
// so only admins may view it.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}
return &siteConfigurationResolver{db: r.db}, nil
}
func (r *siteResolver) ViewerCanAdminister(ctx context.Context) (bool, error) {
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err == backend.ErrMustBeSiteAdmin || err == backend.ErrNotAuthenticated {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err == auth.ErrMustBeSiteAdmin || err == auth.ErrNotAuthenticated {
return false, nil
} else if err != nil {
return false, err
@ -100,7 +100,7 @@ func (r *siteResolver) ConfigurationCascade() *settingsCascade { return r.Settin
func (r *siteResolver) SettingsURL() *string { return strptr("/site-admin/global-settings") }
func (r *siteResolver) CanReloadSite(ctx context.Context) bool {
err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db)
err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db)
return canReloadSite && err == nil
}
@ -128,7 +128,7 @@ type siteConfigurationResolver struct {
func (r *siteConfigurationResolver) ID(ctx context.Context) (int32, error) {
// 🚨 SECURITY: The site configuration contains secret tokens and credentials,
// so only admins may view it.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return 0, err
}
return 0, nil // TODO(slimsag): future: return the real ID here to prevent races
@ -137,7 +137,7 @@ func (r *siteConfigurationResolver) ID(ctx context.Context) (int32, error) {
func (r *siteConfigurationResolver) EffectiveContents(ctx context.Context) (JSONCString, error) {
// 🚨 SECURITY: The site configuration contains secret tokens and credentials,
// so only admins may view it.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return "", err
}
siteConfig, err := conf.RedactSecrets(conf.Raw())
@ -158,7 +158,7 @@ func (r *schemaResolver) UpdateSiteConfiguration(ctx context.Context, args *stru
}) (bool, error) {
// 🚨 SECURITY: The site configuration contains secret tokens and credentials,
// so only admins may view it.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return false, err
}
if !canUpdateSiteConfiguration() {

12
cmd/frontend/graphqlbackend/site_admin.go
View File

@ -8,10 +8,10 @@ import (
"github.com/graph-gophers/graphql-go"
"github.com/inconshreveable/log15"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/envvar"
"github.com/sourcegraph/sourcegraph/cmd/frontend/external/session"
"github.com/sourcegraph/sourcegraph/internal/actor"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/authz"
"github.com/sourcegraph/sourcegraph/internal/database"
"github.com/sourcegraph/sourcegraph/internal/extsvc"
@ -36,7 +36,7 @@ func (r *schemaResolver) DeleteUsers(ctx context.Context, args *struct {
Hard *bool
}) (*EmptyResponse, error) {
// 🚨 SECURITY: Only site admins can delete users.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}
@ -154,7 +154,7 @@ func (r *schemaResolver) hardDelete(ctx context.Context, org graphql.ID) (*Empty
}
//🚨 SECURITY: Only org members can hard delete orgs.
if err := backend.CheckOrgAccess(ctx, r.db, orgID); err != nil {
if err := auth.CheckOrgAccess(ctx, r.db, orgID); err != nil {
return nil, err
}
@ -181,7 +181,7 @@ func (r *schemaResolver) softDelete(ctx context.Context, org graphql.ID) (*Empty
}
// 🚨 SECURITY: For On-premise, only site admins can soft delete orgs.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}
@ -254,7 +254,7 @@ func (r *schemaResolver) SetUserIsSiteAdmin(ctx context.Context, args *struct {
eventName := database.SecurityEventNameRoleChangeDenied
defer logRoleChangeAttempt(ctx, r.db, &eventName, &eventArgs, &err)
if err = backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err = auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}
@ -280,7 +280,7 @@ func (r *schemaResolver) InvalidateSessionsByIDs(ctx context.Context, args *stru
UserIDs []graphql.ID
}) (*EmptyResponse, error) {
// 🚨 SECURITY: Only the site admin can invalidate the sessions of a user
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}
if len(args.UserIDs) == 0 {

4
cmd/frontend/graphqlbackend/site_admin_test.go
View File

@ -9,9 +9,9 @@ import (
"github.com/graph-gophers/graphql-go"
gqlerrors "github.com/graph-gophers/graphql-go/errors"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/envvar"
"github.com/sourcegraph/sourcegraph/internal/actor"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/authz"
"github.com/sourcegraph/sourcegraph/internal/database"
"github.com/sourcegraph/sourcegraph/internal/extsvc"
@ -35,7 +35,7 @@ func TestDeleteUser(t *testing.T) {
}{
User: MarshalUserID(1),
})
if want := backend.ErrMustBeSiteAdmin; err != want {
if want := auth.ErrMustBeSiteAdmin; err != want {
t.Errorf("err: want %q but got %v", want, err)
}
if result != nil {

4
cmd/frontend/graphqlbackend/site_alerts.go
View File

@ -10,10 +10,10 @@ import (
"github.com/Masterminds/semver"
"github.com/inconshreveable/log15"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/hooks"
"github.com/sourcegraph/sourcegraph/cmd/frontend/internal/app/updatecheck"
"github.com/sourcegraph/sourcegraph/internal/actor"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/conf"
"github.com/sourcegraph/sourcegraph/internal/conf/conftypes"
"github.com/sourcegraph/sourcegraph/internal/conf/deploy"
@ -72,7 +72,7 @@ func (r *siteResolver) Alerts(ctx context.Context) ([]*Alert, error) {
args := AlertFuncArgs{
IsAuthenticated: actor.FromContext(ctx).IsAuthenticated(),
IsSiteAdmin: backend.CheckCurrentUserIsSiteAdmin(ctx, r.db) == nil,
IsSiteAdmin: auth.CheckCurrentUserIsSiteAdmin(ctx, r.db) == nil,
ViewerFinalSettings: settings,
}

4
cmd/frontend/graphqlbackend/site_analytics.go
View File

@ -3,8 +3,8 @@ package graphqlbackend
import (
"context"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/internal/adminanalytics"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/database"
"github.com/sourcegraph/sourcegraph/internal/featureflag"
"github.com/sourcegraph/sourcegraph/lib/errors"
@ -17,7 +17,7 @@ type siteAnalyticsResolver struct {
/* Analytics root resolver */
func (r *siteResolver) Analytics(ctx context.Context) (*siteAnalyticsResolver, error) {
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}

4
cmd/frontend/graphqlbackend/site_flags.go
View File

@ -5,7 +5,7 @@ import (
"github.com/sourcegraph/sourcegraph/cmd/frontend/envvar"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/conf"
"github.com/sourcegraph/sourcegraph/internal/database"
)
@ -17,7 +17,7 @@ func (r *siteResolver) NeedsRepositoryConfiguration(ctx context.Context) (bool,
// 🚨 SECURITY: The site alerts may contain sensitive data, so only site
// admins may view them.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
// TODO(dax): This should return err once the site flags query is fixed for users
return false, nil
}

4
cmd/frontend/graphqlbackend/site_reload.go
View File

@ -6,9 +6,9 @@ import (
"github.com/inconshreveable/log15"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/internal/processrestart"
"github.com/sourcegraph/sourcegraph/internal/actor"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/lib/errors"
)
@ -20,7 +20,7 @@ var canReloadSite = processrestart.CanRestart()
func (r *schemaResolver) ReloadSite(ctx context.Context) (*EmptyResponse, error) {
// 🚨 SECURITY: Reloading the site is an interruptive action, so only admins
// may do it.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}

4
cmd/frontend/graphqlbackend/site_update_check.go
View File

@ -4,13 +4,13 @@ import (
"context"
"time"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/internal/app/updatecheck"
"github.com/sourcegraph/sourcegraph/internal/auth"
)
func (r *siteResolver) UpdateCheck(ctx context.Context) (*updateCheckResolver, error) {
// 🚨 SECURITY: Only site admins can check for updates.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
// TODO(dax): This should return err once the site flags query is fixed for users
return &updateCheckResolver{
last: &updatecheck.Status{

4
cmd/frontend/graphqlbackend/site_usage_stats.go
View File

@ -4,7 +4,7 @@ import (
"context"
"time"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/types"
"github.com/sourcegraph/sourcegraph/internal/usagestats"
)
@ -14,7 +14,7 @@ func (r *siteResolver) UsageStatistics(ctx context.Context, args *struct {
Weeks *int32
Months *int32
}) (*siteUsageStatisticsResolver, error) {
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}

4
cmd/frontend/graphqlbackend/site_users.go
View File

@ -6,7 +6,7 @@ import (
"github.com/graph-gophers/graphql-go"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/users"
)
@ -21,7 +21,7 @@ func (s *siteResolver) Users(ctx context.Context, args *struct {
EventsCount *users.UsersStatsNumberRange
}) (*siteUsersResolver, error) {
// 🚨 SECURITY: Only site admins can see users.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, s.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, s.db); err != nil {
return nil, err
}

4
cmd/frontend/graphqlbackend/status_messages.go
View File

@ -5,7 +5,7 @@ import (
"github.com/sourcegraph/log"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/database"
"github.com/sourcegraph/sourcegraph/internal/repos"
"github.com/sourcegraph/sourcegraph/lib/errors"
@ -13,7 +13,7 @@ import (
func (r *schemaResolver) StatusMessages(ctx context.Context) ([]*statusMessageResolver, error) {
// 🚨 SECURITY: Only site admins can fetch status messages.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}

4
cmd/frontend/graphqlbackend/status_messages_test.go
View File

@ -4,7 +4,7 @@ import (
"context"
"testing"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/database"
"github.com/sourcegraph/sourcegraph/internal/extsvc"
"github.com/sourcegraph/sourcegraph/internal/repos"
@ -43,7 +43,7 @@ func TestStatusMessages(t *testing.T) {
db.UsersFunc.SetDefaultReturn(users)
result, err := newSchemaResolver(db).StatusMessages(context.Background())
if want := backend.ErrNotAuthenticated; err != want {
if want := auth.ErrNotAuthenticated; err != want {
t.Errorf("got err %v, want %v", err, want)
}
if result != nil {

12
cmd/frontend/graphqlbackend/survey_responses.go
View File

@ -3,8 +3,8 @@ package graphqlbackend
import (
"context"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/graphqlbackend/graphqlutil"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/database"
)
@ -23,7 +23,7 @@ func (r *schemaResolver) SurveyResponses(args *struct {
func (r *surveyResponseConnectionResolver) Nodes(ctx context.Context) ([]*surveyResponseResolver, error) {
// 🚨 SECURITY: Survey responses can only be viewed by site admins.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}
@ -42,7 +42,7 @@ func (r *surveyResponseConnectionResolver) Nodes(ctx context.Context) ([]*survey
func (r *surveyResponseConnectionResolver) TotalCount(ctx context.Context) (int32, error) {
// 🚨 SECURITY: Only site admins can count survey responses.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return 0, err
}
@ -52,7 +52,7 @@ func (r *surveyResponseConnectionResolver) TotalCount(ctx context.Context) (int3
func (r *surveyResponseConnectionResolver) AverageScore(ctx context.Context) (float64, error) {
// 🚨 SECURITY: Only site admins can see average scores.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return 0, err
}
return database.SurveyResponses(r.db).Last30DaysAverageScore(ctx)
@ -60,7 +60,7 @@ func (r *surveyResponseConnectionResolver) AverageScore(ctx context.Context) (fl
func (r *surveyResponseConnectionResolver) NetPromoterScore(ctx context.Context) (int32, error) {
// 🚨 SECURITY: Only site admins can see net promoter scores.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return 0, err
}
nps, err := database.SurveyResponses(r.db).Last30DaysNetPromoterScore(ctx)
@ -69,7 +69,7 @@ func (r *surveyResponseConnectionResolver) NetPromoterScore(ctx context.Context)
func (r *surveyResponseConnectionResolver) Last30DaysCount(ctx context.Context) (int32, error) {
// 🚨 SECURITY: Only site admins can count survey responses.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return 0, err
}
count, err := database.SurveyResponses(r.db).Last30DaysCount(ctx)

4
cmd/frontend/graphqlbackend/tags.go
View File

@ -5,7 +5,7 @@ import (
"github.com/graph-gophers/graphql-go"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/lib/errors"
)
@ -15,7 +15,7 @@ func (r *schemaResolver) SetTag(ctx context.Context, args *struct {
Present bool
}) (*EmptyResponse, error) {
// 🚨 SECURITY: Only site admins may set tags.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}

37
cmd/frontend/graphqlbackend/user.go
View File

@ -15,6 +15,7 @@ import (
"github.com/sourcegraph/sourcegraph/cmd/frontend/envvar"
"github.com/sourcegraph/sourcegraph/cmd/frontend/internal/suspiciousnames"
"github.com/sourcegraph/sourcegraph/internal/api"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/conf"
"github.com/sourcegraph/sourcegraph/internal/database"
"github.com/sourcegraph/sourcegraph/internal/errcode"
@ -41,7 +42,7 @@ func (r *schemaResolver) User(
// 🚨 SECURITY: Only site admins are allowed to look up by email address on
// Sourcegraph.com, for user privacy reasons.
if envvar.SourcegraphDotComMode() {
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}
}
@ -112,12 +113,12 @@ func (r *UserResolver) Email(ctx context.Context) (string, error) {
// 🚨 SECURITY: Only the authenticated user can view their email on
// Sourcegraph.com.
if envvar.SourcegraphDotComMode() {
if err := backend.CheckSameUser(ctx, r.user.ID); err != nil {
if err := auth.CheckSameUser(ctx, r.user.ID); err != nil {
return "", err
}
} else {
// 🚨 SECURITY: Only the user and admins are allowed to access the email address.
if err := backend.CheckSiteAdminOrSameUser(ctx, r.db, r.user.ID); err != nil {
if err := auth.CheckSiteAdminOrSameUser(ctx, r.db, r.user.ID); err != nil {
return "", err
}
}
@ -172,13 +173,13 @@ func (r *UserResolver) LatestSettings(ctx context.Context) (*settingsResolver, e
// 🚨 SECURITY: Only the authenticated user can view their settings on
// Sourcegraph.com.
if envvar.SourcegraphDotComMode() {
if err := backend.CheckSameUser(ctx, r.user.ID); err != nil {
if err := auth.CheckSameUser(ctx, r.user.ID); err != nil {
return nil, err
}
} else {
// 🚨 SECURITY: Only the user and admins are allowed to access the user's
// settings, because they may contain secrets or other sensitive data.
if err := backend.CheckSiteAdminOrSameUser(ctx, r.db, r.user.ID); err != nil {
if err := auth.CheckSiteAdminOrSameUser(ctx, r.db, r.user.ID); err != nil {
return nil, err
}
}
@ -201,7 +202,7 @@ func (r *UserResolver) ConfigurationCascade() *settingsCascade { return r.Settin
func (r *UserResolver) SiteAdmin(ctx context.Context) (bool, error) {
// 🚨 SECURITY: Only the user and admins are allowed to determine if the user is a site admin.
if err := backend.CheckSiteAdminOrSameUser(ctx, r.db, r.user.ID); err != nil {
if err := auth.CheckSiteAdminOrSameUser(ctx, r.db, r.user.ID); err != nil {
return false, err
}
@ -232,12 +233,12 @@ func (r *schemaResolver) UpdateUser(ctx context.Context, args *updateUserArgs) (
// 🚨 SECURITY: Only the authenticated user can update their properties on
// Sourcegraph.com.
if envvar.SourcegraphDotComMode() {
if err := backend.CheckSameUser(ctx, userID); err != nil {
if err := auth.CheckSameUser(ctx, userID); err != nil {
return nil, err
}
} else {
// 🚨 SECURITY: Only the user and site admins are allowed to update the user.
if err := backend.CheckSiteAdminOrSameUser(ctx, r.db, userID); err != nil {
if err := auth.CheckSiteAdminOrSameUser(ctx, r.db, userID); err != nil {
return nil, err
}
}
@ -293,7 +294,7 @@ func CurrentUser(ctx context.Context, db database.DB) (*UserResolver, error) {
func (r *UserResolver) Organizations(ctx context.Context) (*orgConnectionStaticResolver, error) {
// 🚨 SECURITY: Only the user and admins are allowed to access the user's
// organisations.
if err := backend.CheckSiteAdminOrSameUser(ctx, r.db, r.user.ID); err != nil {
if err := auth.CheckSiteAdminOrSameUser(ctx, r.db, r.user.ID); err != nil {
return nil, err
}
orgs, err := r.db.Orgs().GetByUserID(ctx, r.user.ID)
@ -309,7 +310,7 @@ func (r *UserResolver) Organizations(ctx context.Context) (*orgConnectionStaticR
func (r *UserResolver) Tags(ctx context.Context) ([]string, error) {
// 🚨 SECURITY: Only the user and admins are allowed to access the user's tags.
if err := backend.CheckSiteAdminOrSameUser(ctx, r.db, r.user.ID); err != nil {
if err := auth.CheckSiteAdminOrSameUser(ctx, r.db, r.user.ID); err != nil {
return nil, err
}
return r.user.Tags, nil
@ -317,7 +318,7 @@ func (r *UserResolver) Tags(ctx context.Context) ([]string, error) {
func (r *UserResolver) SurveyResponses(ctx context.Context) ([]*surveyResponseResolver, error) {
// 🚨 SECURITY: Only the user and admins are allowed to access the user's survey responses.
if err := backend.CheckSiteAdminOrSameUser(ctx, r.db, r.user.ID); err != nil {
if err := auth.CheckSiteAdminOrSameUser(ctx, r.db, r.user.ID); err != nil {
return nil, err
}
@ -337,9 +338,9 @@ func (r *UserResolver) ViewerCanAdminister(ctx context.Context) (bool, error) {
// Sourcegraph.com.
var err error
if envvar.SourcegraphDotComMode() {
err = backend.CheckSameUser(ctx, r.user.ID)
err = auth.CheckSameUser(ctx, r.user.ID)
} else {
err = backend.CheckSiteAdminOrSameUser(ctx, r.db, r.user.ID)
err = auth.CheckSiteAdminOrSameUser(ctx, r.db, r.user.ID)
}
if errcode.IsUnauthorized(err) {
return false, nil
@ -422,7 +423,7 @@ func (r *schemaResolver) SetTosAccepted(ctx context.Context, args *struct{ UserI
}
// 🚨 SECURITY: Only the user and admins are allowed to set the Terms of Service accepted flag.
if err := backend.CheckSiteAdminOrSameUser(ctx, r.db, affectedUserID); err != nil {
if err := auth.CheckSiteAdminOrSameUser(ctx, r.db, affectedUserID); err != nil {
return nil, err
}
@ -476,14 +477,14 @@ func (r *UserResolver) BatchChangesCodeHosts(ctx context.Context, args *ListBatc
}
func viewerCanChangeUsername(ctx context.Context, db database.DB, userID int32) bool {
if err := backend.CheckSiteAdminOrSameUser(ctx, db, userID); err != nil {
if err := auth.CheckSiteAdminOrSameUser(ctx, db, userID); err != nil {
return false
}
if conf.Get().AuthEnableUsernameChanges {
return true
}
// 🚨 SECURITY: Only site admins are allowed to change a user's username when auth.enableUsernameChanges == false.
return backend.CheckCurrentUserIsSiteAdmin(ctx, db) == nil
return auth.CheckCurrentUserIsSiteAdmin(ctx, db) == nil
}
// Users may be trying to change their own username, or someone else's.
@ -504,14 +505,14 @@ func viewerIsChangingUsername(ctx context.Context, db database.DB, subjectUserID
}
func (r *UserResolver) Monitors(ctx context.Context, args *ListMonitorsArgs) (MonitorConnectionResolver, error) {
if err := backend.CheckSameUser(ctx, r.user.ID); err != nil {
if err := auth.CheckSameUser(ctx, r.user.ID); err != nil {
return nil, err
}
return EnterpriseResolvers.codeMonitorsResolver.Monitors(ctx, r.user.ID, args)
}
func (r *UserResolver) PublicRepositories(ctx context.Context) ([]*RepositoryResolver, error) {
if err := backend.CheckSiteAdminOrSameUser(ctx, r.db, r.user.ID); err != nil {
if err := auth.CheckSiteAdminOrSameUser(ctx, r.db, r.user.ID); err != nil {
return nil, err
}
repos, err := r.db.UserPublicRepos().ListByUser(ctx, r.user.ID)

23
cmd/frontend/graphqlbackend/user_emails.go
View File

@ -9,6 +9,7 @@ import (
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/envvar"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/authz"
"github.com/sourcegraph/sourcegraph/internal/conf"
"github.com/sourcegraph/sourcegraph/internal/database"
@ -20,7 +21,7 @@ var timeNow = time.Now
func (r *UserResolver) Emails(ctx context.Context) ([]*userEmailResolver, error) {
// 🚨 SECURITY: Only the authenticated user and site admins can list user's
// emails.
if err := backend.CheckSiteAdminOrSameUser(ctx, r.db, r.user.ID); err != nil {
if err := auth.CheckSiteAdminOrSameUser(ctx, r.db, r.user.ID); err != nil {
return nil, err
}
@ -64,7 +65,7 @@ func (r *userEmailResolver) ViewerCanManuallyVerify(ctx context.Context) (bool,
return false, nil
}
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err == backend.ErrNotAuthenticated || err == backend.ErrMustBeSiteAdmin {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err == auth.ErrNotAuthenticated || err == auth.ErrMustBeSiteAdmin {
return false, nil
} else if err != nil {
return false, err
@ -86,13 +87,13 @@ func (r *schemaResolver) AddUserEmail(ctx context.Context, args *addUserEmailArg
// 🚨 SECURITY: Only the authenticated user can add new email to their accounts
// on Sourcegraph.com.
if envvar.SourcegraphDotComMode() {
if err := backend.CheckSameUser(ctx, userID); err != nil {
if err := auth.CheckSameUser(ctx, userID); err != nil {
return nil, err
}
} else {
// 🚨 SECURITY: Only the authenticated user or site admins can add new email to
// users' accounts.
if err := backend.CheckSiteAdminOrSameUser(ctx, r.db, userID); err != nil {
if err := auth.CheckSiteAdminOrSameUser(ctx, r.db, userID); err != nil {
return nil, err
}
}
@ -124,13 +125,13 @@ func (r *schemaResolver) RemoveUserEmail(ctx context.Context, args *removeUserEm
// 🚨 SECURITY: Only the authenticated user can remove email from their accounts
// on Sourcegraph.com.
if envvar.SourcegraphDotComMode() {
if err := backend.CheckSameUser(ctx, userID); err != nil {
if err := auth.CheckSameUser(ctx, userID); err != nil {
return nil, err
}
} else {
// 🚨 SECURITY: Only the authenticated user and site admins can remove email
// from users' accounts.
if err := backend.CheckSiteAdminOrSameUser(ctx, r.db, userID); err != nil {
if err := auth.CheckSiteAdminOrSameUser(ctx, r.db, userID); err != nil {
return nil, err
}
}
@ -167,13 +168,13 @@ func (r *schemaResolver) SetUserEmailPrimary(ctx context.Context, args *setUserE
// 🚨 SECURITY: Only the authenticated user can set the primary email for their
// accounts on Sourcegraph.com.
if envvar.SourcegraphDotComMode() {
if err := backend.CheckSameUser(ctx, userID); err != nil {
if err := auth.CheckSameUser(ctx, userID); err != nil {
return nil, err
}
} else {
// 🚨 SECURITY: Only the authenticated user and site admins can set the primary
// email for users' accounts.
if err := backend.CheckSiteAdminOrSameUser(ctx, r.db, userID); err != nil {
if err := auth.CheckSiteAdminOrSameUser(ctx, r.db, userID); err != nil {
return nil, err
}
}
@ -205,7 +206,7 @@ func (r *schemaResolver) SetUserEmailVerified(ctx context.Context, args *setUser
// 🚨 SECURITY: Only site admins (NOT users themselves) can manually set email verification
// status. Users themselves must go through the normal email verification process.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}
@ -248,13 +249,13 @@ func (r *schemaResolver) ResendVerificationEmail(ctx context.Context, args *rese
// 🚨 SECURITY: Only the authenticated user can resend verification email for
// their accounts on Sourcegraph.com.
if envvar.SourcegraphDotComMode() {
if err := backend.CheckSameUser(ctx, userID); err != nil {
if err := auth.CheckSameUser(ctx, userID); err != nil {
return nil, err
}
} else {
// 🚨 SECURITY: Only the authenticated user and site admins can resend
// verification email for their accounts.
if err := backend.CheckSiteAdminOrSameUser(ctx, r.db, userID); err != nil {
if err := auth.CheckSiteAdminOrSameUser(ctx, r.db, userID); err != nil {
return nil, err
}
}

4
cmd/frontend/graphqlbackend/user_usage_stats.go
View File

@ -10,9 +10,9 @@ import (
"github.com/prometheus/client_golang/prometheus"
"github.com/prometheus/client_golang/prometheus/promauto"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/envvar"
"github.com/sourcegraph/sourcegraph/internal/actor"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/conf"
"github.com/sourcegraph/sourcegraph/internal/featureflag"
"github.com/sourcegraph/sourcegraph/internal/trace"
@ -22,7 +22,7 @@ import (
func (r *UserResolver) UsageStatistics(ctx context.Context) (*userUsageStatisticsResolver, error) {
if envvar.SourcegraphDotComMode() {
if err := backend.CheckSiteAdminOrSameUser(ctx, r.db, r.user.ID); err != nil {
if err := auth.CheckSiteAdminOrSameUser(ctx, r.db, r.user.ID); err != nil {
return nil, err
}
}

6
cmd/frontend/graphqlbackend/users.go
View File

@ -6,8 +6,8 @@ import (
"github.com/sourcegraph/log"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/graphqlbackend/graphqlutil"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/codeintel/autoindexing/transport/graphql"
"github.com/sourcegraph/sourcegraph/internal/database"
"github.com/sourcegraph/sourcegraph/internal/types"
@ -93,7 +93,7 @@ func (r *userConnectionResolver) compute(ctx context.Context) ([]*types.User, in
func (r *userConnectionResolver) Nodes(ctx context.Context) ([]*UserResolver, error) {
// 🚨 SECURITY: Only site admins can list users.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}
@ -123,7 +123,7 @@ func (r *userConnectionResolver) Nodes(ctx context.Context) ([]*UserResolver, er
func (r *userConnectionResolver) TotalCount(ctx context.Context) (int32, error) {
// 🚨 SECURITY: Only site admins can count users.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return 0, err
}

3
cmd/frontend/graphqlbackend/users_create.go
View File

@ -8,6 +8,7 @@ import (
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/globals"
"github.com/sourcegraph/sourcegraph/cmd/frontend/internal/auth/userpasswd"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/authz"
"github.com/sourcegraph/sourcegraph/internal/conf"
"github.com/sourcegraph/sourcegraph/internal/database"
@ -19,7 +20,7 @@ func (r *schemaResolver) CreateUser(ctx context.Context, args *struct {
Email *string
}) (*createUserResult, error) {
// 🚨 SECURITY: Only site admins can create user accounts.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}

3
cmd/frontend/graphqlbackend/users_randomize_password.go
View File

@ -10,6 +10,7 @@ import (
"github.com/sourcegraph/sourcegraph/cmd/frontend/envvar"
"github.com/sourcegraph/sourcegraph/cmd/frontend/globals"
"github.com/sourcegraph/sourcegraph/cmd/frontend/internal/auth/userpasswd"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/conf"
"github.com/sourcegraph/sourcegraph/internal/database"
"github.com/sourcegraph/sourcegraph/lib/errors"
@ -55,7 +56,7 @@ func (r *schemaResolver) RandomizeUserPassword(ctx context.Context, args *struct
return nil, errors.New("unable to reset password because email sending is not configured")
}
// 🚨 SECURITY: Only site admins can randomize user passwords.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}

6
cmd/frontend/graphqlbackend/webhook_logs.go
View File

@ -12,8 +12,8 @@ import (
"github.com/sourcegraph/log"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/graphqlbackend/graphqlutil"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/database"
"github.com/sourcegraph/sourcegraph/internal/encryption/keyring"
"github.com/sourcegraph/sourcegraph/internal/types"
@ -115,7 +115,7 @@ func newWebhookLogConnectionResolver(
ctx context.Context, db database.DB, args *webhookLogsArgs,
externalServiceID webhookLogsExternalServiceID,
) (*webhookLogConnectionResolver, error) {
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, db); err != nil {
return nil, err
}
@ -198,7 +198,7 @@ func unmarshalWebhookLogID(id graphql.ID) (logID int64, err error) {
}
func webhookLogByID(ctx context.Context, db database.DB, gqlID graphql.ID) (*webhookLogResolver, error) {
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, db); err != nil {
return nil, err
}

6
cmd/frontend/graphqlbackend/webhook_logs_test.go
View File

@ -8,8 +8,8 @@ import (
mockassert "github.com/derision-test/go-mockgen/testutil/assert"
"github.com/stretchr/testify/assert"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/graphqlbackend/graphqlutil"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/database"
"github.com/sourcegraph/sourcegraph/internal/types"
"github.com/sourcegraph/sourcegraph/lib/errors"
@ -101,7 +101,7 @@ func TestNewWebhookLogConnectionResolver(t *testing.T) {
db.UsersFunc.SetDefaultReturn(users)
_, err := newWebhookLogConnectionResolver(context.Background(), db, nil, webhookLogsUnmatchedExternalService)
assert.ErrorIs(t, err, backend.ErrNotAuthenticated)
assert.ErrorIs(t, err, auth.ErrNotAuthenticated)
})
t.Run("regular user", func(t *testing.T) {
@ -112,7 +112,7 @@ func TestNewWebhookLogConnectionResolver(t *testing.T) {
db.UsersFunc.SetDefaultReturn(users)
_, err := newWebhookLogConnectionResolver(context.Background(), db, nil, webhookLogsUnmatchedExternalService)
assert.ErrorIs(t, err, backend.ErrMustBeSiteAdmin)
assert.ErrorIs(t, err, auth.ErrMustBeSiteAdmin)
})
t.Run("admin user", func(t *testing.T) {

4
cmd/frontend/internal/app/debug.go
View File

@ -18,9 +18,9 @@ import (
sglog "github.com/sourcegraph/log"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/internal/app/debugproxies"
"github.com/sourcegraph/sourcegraph/cmd/frontend/internal/app/otlpadapter"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/conf"
"github.com/sourcegraph/sourcegraph/internal/conf/conftypes"
"github.com/sourcegraph/sourcegraph/internal/conf/deploy"
@ -319,7 +319,7 @@ func addOpenTelemetryProtocolAdapter(r *mux.Router) {
// adminOnly is a HTTP middleware which only allows requests by admins.
func adminOnly(next http.Handler, db database.DB) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
if err := backend.CheckCurrentUserIsSiteAdmin(r.Context(), db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(r.Context(), db); err != nil {
http.Error(w, err.Error(), http.StatusUnauthorized)
return
}

4
cmd/frontend/internal/app/debugproxies/handler.go
View File

@ -11,8 +11,8 @@ import (
"github.com/gorilla/mux"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/internal/app/errorutil"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/database"
"github.com/sourcegraph/sourcegraph/internal/env"
"github.com/sourcegraph/sourcegraph/internal/errcode"
@ -146,7 +146,7 @@ func reverseProxyFromHost(db database.DB, host string, pathPrefix string) http.H
// adminOnly is a HTTP middleware which only allows requests by admins.
func adminOnly(db database.DB, next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
if err := backend.CheckCurrentUserIsSiteAdmin(r.Context(), db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(r.Context(), db); err != nil {
http.Error(w, err.Error(), http.StatusUnauthorized)
return
}

5
cmd/frontend/internal/app/one_click_export.go
View File

@ -6,8 +6,9 @@ import (
"net/http"
"github.com/sourcegraph/log"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
oce "github.com/sourcegraph/sourcegraph/cmd/frontend/oneclickexport"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/database"
)
@ -15,7 +16,7 @@ func oneClickExportHandler(db database.DB, logger log.Logger) http.HandlerFunc {
return func(w http.ResponseWriter, r *http.Request) {
// 🚨SECURITY: Only site admins may get this archive.
ctx := r.Context()
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, db); err != nil {
w.WriteHeader(http.StatusUnauthorized)
return
}

4
cmd/frontend/internal/app/ping.go
View File

@ -7,7 +7,7 @@ import (
"github.com/inconshreveable/log15"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/database"
)
@ -16,7 +16,7 @@ import (
func latestPingHandler(db database.DB) http.HandlerFunc {
return func(w http.ResponseWriter, r *http.Request) {
// 🚨SECURITY: Only site admins may access ping data.
if err := backend.CheckCurrentUserIsSiteAdmin(r.Context(), db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(r.Context(), db); err != nil {
w.WriteHeader(http.StatusUnauthorized)
return
}

4
cmd/frontend/internal/app/usage_stats.go
View File

@ -5,7 +5,7 @@ import (
"github.com/inconshreveable/log15"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/database"
"github.com/sourcegraph/sourcegraph/internal/usagestats"
)
@ -13,7 +13,7 @@ import (
func usageStatsArchiveHandler(db database.DB) http.HandlerFunc {
return func(w http.ResponseWriter, r *http.Request) {
// 🚨SECURITY: Only site admins may get this archive.
if err := backend.CheckCurrentUserIsSiteAdmin(r.Context(), db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(r.Context(), db); err != nil {
w.WriteHeader(http.StatusUnauthorized)
return
}

4
cmd/frontend/internal/httpapi/auth.go
View File

@ -5,8 +5,8 @@ import (
"github.com/inconshreveable/log15"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/internal/actor"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/authz"
"github.com/sourcegraph/sourcegraph/internal/conf"
"github.com/sourcegraph/sourcegraph/internal/database"
@ -89,7 +89,7 @@ func AccessTokenAuthMiddleware(db database.DB, next http.Handler) http.Handler {
} else {
// 🚨 SECURITY: Confirm that the sudo token's subject is still a site admin, to
// prevent users from retaining site admin privileges after being demoted.
if err := backend.CheckUserIsSiteAdmin(r.Context(), db, subjectUserID); err != nil {
if err := auth.CheckUserIsSiteAdmin(r.Context(), db, subjectUserID); err != nil {
log15.Error("Sudo access token's subject is not a site admin.", "subjectUserID", subjectUserID, "err", err)
http.Error(w, "The subject user of a sudo access token must be a site admin.", http.StatusForbidden)
return

8
enterprise/cmd/frontend/internal/app/app.go
View File

@ -20,16 +20,16 @@ import (
"github.com/sourcegraph/log"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/enterprise"
"github.com/sourcegraph/sourcegraph/cmd/frontend/envvar"
"github.com/sourcegraph/sourcegraph/cmd/frontend/graphqlbackend"
"github.com/sourcegraph/sourcegraph/internal/actor"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/conf"
"github.com/sourcegraph/sourcegraph/internal/conf/conftypes"
"github.com/sourcegraph/sourcegraph/internal/database"
"github.com/sourcegraph/sourcegraph/internal/extsvc"
"github.com/sourcegraph/sourcegraph/internal/extsvc/auth"
extsvcauth "github.com/sourcegraph/sourcegraph/internal/extsvc/auth"
"github.com/sourcegraph/sourcegraph/internal/extsvc/github"
"github.com/sourcegraph/sourcegraph/internal/jsonc"
"github.com/sourcegraph/sourcegraph/internal/repos"
@ -63,7 +63,7 @@ func Init(
}
appID = gitHubAppConfig.AppID
auther, err := auth.NewOAuthBearerTokenWithGitHubApp(appID, privateKey)
auther, err := extsvcauth.NewOAuthBearerTokenWithGitHubApp(appID, privateKey)
if err != nil {
return errors.Wrap(err, "new authenticator with GitHub App")
}
@ -298,7 +298,7 @@ func newGitHubAppSetupHandler(db database.DB, apiURL *url.URL, client githubClie
return
}
err = backend.CheckOrgAccess(r.Context(), db, orgID)
err = auth.CheckOrgAccess(r.Context(), db, orgID)
if err != nil {
w.WriteHeader(http.StatusBadRequest)
_, _ = w.Write([]byte("the authenticated user does not belong to the organization requested"))

6
enterprise/cmd/frontend/internal/authz/init.go
View File

@ -9,7 +9,6 @@ import (
"github.com/inconshreveable/log15"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/enterprise"
"github.com/sourcegraph/sourcegraph/cmd/frontend/graphqlbackend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/hooks"
@ -19,6 +18,7 @@ import (
edb "github.com/sourcegraph/sourcegraph/enterprise/internal/database"
"github.com/sourcegraph/sourcegraph/enterprise/internal/licensing"
"github.com/sourcegraph/sourcegraph/internal/actor"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/authz"
"github.com/sourcegraph/sourcegraph/internal/conf"
"github.com/sourcegraph/sourcegraph/internal/conf/conftypes"
@ -137,13 +137,13 @@ func Init(ctx context.Context, db database.DB, _ conftypes.UnifiedWatchable, ent
}
siteadminOrHandler := func(handler func()) {
err := backend.CheckCurrentUserIsSiteAdmin(r.Context(), db)
err := auth.CheckCurrentUserIsSiteAdmin(r.Context(), db)
if err == nil {
// User is site admin, let them proceed.
next.ServeHTTP(w, r)
return
}
if err != backend.ErrMustBeSiteAdmin {
if err != auth.ErrMustBeSiteAdmin {
log15.Error("Error checking current user is site admin", "err", err)
http.Error(w, "Error checking current user is site admin. Site admins may check the logs for more information.", http.StatusInternalServerError)
return

8
enterprise/cmd/frontend/internal/authz/resolvers/repositories.go
View File

@ -6,10 +6,10 @@ import (
"github.com/graph-gophers/graphql-go"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/graphqlbackend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/graphqlbackend/graphqlutil"
"github.com/sourcegraph/sourcegraph/internal/api"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/database"
"github.com/sourcegraph/sourcegraph/internal/gitserver"
"github.com/sourcegraph/sourcegraph/internal/types"
@ -101,7 +101,7 @@ func (r *repositoryConnectionResolver) compute(ctx context.Context) ([]*types.Re
func (r *repositoryConnectionResolver) Nodes(ctx context.Context) ([]*graphqlbackend.RepositoryResolver, error) {
// 🚨 SECURITY: Only site admins may access this method.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}
@ -118,7 +118,7 @@ func (r *repositoryConnectionResolver) Nodes(ctx context.Context) ([]*graphqlbac
func (r *repositoryConnectionResolver) TotalCount(ctx context.Context, args *graphqlbackend.TotalCountArgs) (*int32, error) {
// 🚨 SECURITY: Only site admins may access this method.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}
@ -128,7 +128,7 @@ func (r *repositoryConnectionResolver) TotalCount(ctx context.Context, args *gra
func (r *repositoryConnectionResolver) PageInfo(ctx context.Context) (*graphqlutil.PageInfo, error) {
// 🚨 SECURITY: Only site admins may access this method.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}

26
enterprise/cmd/frontend/internal/authz/resolvers/resolver.go
View File

@ -8,13 +8,13 @@ import (
"github.com/graph-gophers/graphql-go"
"github.com/inconshreveable/log15"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/envvar"
"github.com/sourcegraph/sourcegraph/cmd/frontend/globals"
"github.com/sourcegraph/sourcegraph/cmd/frontend/graphqlbackend"
edb "github.com/sourcegraph/sourcegraph/enterprise/internal/database"
"github.com/sourcegraph/sourcegraph/enterprise/internal/licensing"
"github.com/sourcegraph/sourcegraph/internal/api"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/authz"
"github.com/sourcegraph/sourcegraph/internal/database"
"github.com/sourcegraph/sourcegraph/internal/errcode"
@ -66,7 +66,7 @@ func (r *Resolver) SetRepositoryPermissionsForUsers(ctx context.Context, args *g
}
// 🚨 SECURITY: Only site admins can mutate repository permissions.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}
@ -137,7 +137,7 @@ func (r *Resolver) SetRepositoryPermissionsUnrestricted(ctx context.Context, arg
return nil, err
}
// 🚨 SECURITY: Only site admins can mutate repository permissions.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}
@ -163,7 +163,7 @@ func (r *Resolver) ScheduleRepositoryPermissionsSync(ctx context.Context, args *
}
// 🚨 SECURITY: Only site admins can query repository permissions.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}
@ -187,7 +187,7 @@ func (r *Resolver) ScheduleUserPermissionsSync(ctx context.Context, args *graphq
}
// 🚨 SECURITY: Only site admins can query repository permissions.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}
@ -218,7 +218,7 @@ func (r *Resolver) SetSubRepositoryPermissionsForUsers(ctx context.Context, args
}
// 🚨 SECURITY: Only site admins can mutate repository permissions.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}
@ -312,7 +312,7 @@ func (r *Resolver) SetRepositoryPermissionsForBitbucketProject(
return nil, err
}
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}
@ -352,7 +352,7 @@ func (r *Resolver) AuthorizedUserRepositories(ctx context.Context, args *graphql
}
// 🚨 SECURITY: Only site admins can query repository permissions.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}
@ -413,7 +413,7 @@ func (r *Resolver) AuthorizedUserRepositories(ctx context.Context, args *graphql
func (r *Resolver) UsersWithPendingPermissions(ctx context.Context) ([]string, error) {
// 🚨 SECURITY: Only site admins can query repository permissions.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}
@ -422,7 +422,7 @@ func (r *Resolver) UsersWithPendingPermissions(ctx context.Context) ([]string, e
func (r *Resolver) AuthorizedUsers(ctx context.Context, args *graphqlbackend.RepoAuthorizedUserArgs) (graphqlbackend.UserConnectionResolver, error) {
// 🚨 SECURITY: Only site admins can query repository permissions.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}
@ -470,7 +470,7 @@ func (r *Resolver) BitbucketProjectPermissionJobs(ctx context.Context, args *gra
return nil, errDisabledSourcegraphDotCom
}
// 🚨 SECURITY: Only site admins can query repository permissions.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}
loweredAndTrimmedStatus := strings.ToLower(strings.TrimSpace(getOrDefault(args.Status)))
@ -537,7 +537,7 @@ func (r *permissionsInfoResolver) Unrestricted() bool {
func (r *Resolver) RepositoryPermissionsInfo(ctx context.Context, id graphql.ID) (graphqlbackend.PermissionsInfoResolver, error) {
// 🚨 SECURITY: Only site admins can query repository permissions.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}
@ -573,7 +573,7 @@ func (r *Resolver) RepositoryPermissionsInfo(ctx context.Context, id graphql.ID)
func (r *Resolver) UserPermissionsInfo(ctx context.Context, id graphql.ID) (graphqlbackend.PermissionsInfoResolver, error) {
// 🚨 SECURITY: Only site admins can query user permissions.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}

28
enterprise/cmd/frontend/internal/authz/resolvers/resolver_test.go
View File

@ -13,7 +13,6 @@ import (
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/envvar"
"github.com/sourcegraph/sourcegraph/cmd/frontend/globals"
"github.com/sourcegraph/sourcegraph/cmd/frontend/graphqlbackend"
@ -21,6 +20,7 @@ import (
"github.com/sourcegraph/sourcegraph/enterprise/internal/licensing"
"github.com/sourcegraph/sourcegraph/internal/actor"
"github.com/sourcegraph/sourcegraph/internal/api"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/authz"
"github.com/sourcegraph/sourcegraph/internal/database"
"github.com/sourcegraph/sourcegraph/internal/extsvc"
@ -61,7 +61,7 @@ func TestResolver_SetRepositoryPermissionsForUsers(t *testing.T) {
ctx := actor.WithActor(context.Background(), &actor.Actor{UID: 1})
result, err := (&Resolver{db: db}).SetRepositoryPermissionsForUsers(ctx, &graphqlbackend.RepoPermsArgs{})
if want := backend.ErrMustBeSiteAdmin; err != want {
if want := auth.ErrMustBeSiteAdmin; err != want {
t.Errorf("err: want %q but got %v", want, err)
}
if result != nil {
@ -234,7 +234,7 @@ func TestResolver_SetRepositoryPermissionsUnrestricted(t *testing.T) {
ctx := actor.WithActor(context.Background(), &actor.Actor{UID: 1})
result, err := (&Resolver{db: db}).SetRepositoryPermissionsForUsers(ctx, &graphqlbackend.RepoPermsArgs{})
if want := backend.ErrMustBeSiteAdmin; err != want {
if want := auth.ErrMustBeSiteAdmin; err != want {
t.Errorf("err: want %q but got %v", want, err)
}
if result != nil {
@ -295,7 +295,7 @@ func TestResolver_ScheduleRepositoryPermissionsSync(t *testing.T) {
ctx := actor.WithActor(context.Background(), &actor.Actor{UID: 1})
result, err := (&Resolver{db: db}).ScheduleRepositoryPermissionsSync(ctx, &graphqlbackend.RepositoryIDArgs{})
if want := backend.ErrMustBeSiteAdmin; err != want {
if want := auth.ErrMustBeSiteAdmin; err != want {
t.Errorf("err: want %q but got %v", want, err)
}
if result != nil {
@ -339,7 +339,7 @@ func TestResolver_ScheduleUserPermissionsSync(t *testing.T) {
ctx := actor.WithActor(context.Background(), &actor.Actor{UID: 1})
result, err := (&Resolver{db: db}).ScheduleUserPermissionsSync(ctx, &graphqlbackend.UserPermissionsSyncArgs{})
if want := backend.ErrMustBeSiteAdmin; err != want {
if want := auth.ErrMustBeSiteAdmin; err != want {
t.Errorf("err: want %q but got %v", want, err)
}
if result != nil {
@ -438,8 +438,8 @@ func TestResolver_SetRepositoryPermissionsForBitbucketProject(t *testing.T) {
ctx := actor.WithActor(context.Background(), &actor.Actor{UID: 1})
result, err := r.SetRepositoryPermissionsForBitbucketProject(ctx, nil)
if !errors.Is(err, backend.ErrMustBeSiteAdmin) {
t.Errorf("err: want %q, but got %q", backend.ErrMustBeSiteAdmin, err)
if !errors.Is(err, auth.ErrMustBeSiteAdmin) {
t.Errorf("err: want %q, but got %q", auth.ErrMustBeSiteAdmin, err)
}
if result != nil {
@ -602,7 +602,7 @@ func TestResolver_AuthorizedUserRepositories(t *testing.T) {
ctx := actor.WithActor(context.Background(), &actor.Actor{UID: 1})
result, err := (&Resolver{db: db}).AuthorizedUserRepositories(ctx, &graphqlbackend.AuthorizedRepoArgs{})
if want := backend.ErrMustBeSiteAdmin; err != want {
if want := auth.ErrMustBeSiteAdmin; err != want {
t.Errorf("err: want %q but got %v", want, err)
}
if result != nil {
@ -869,7 +869,7 @@ func TestResolver_UsersWithPendingPermissions(t *testing.T) {
ctx := actor.WithActor(context.Background(), &actor.Actor{UID: 1})
result, err := (&Resolver{db: db}).UsersWithPendingPermissions(ctx)
if want := backend.ErrMustBeSiteAdmin; err != want {
if want := auth.ErrMustBeSiteAdmin; err != want {
t.Errorf("err: want %q but got %v", want, err)
}
if result != nil {
@ -930,7 +930,7 @@ func TestResolver_AuthorizedUsers(t *testing.T) {
ctx := actor.WithActor(context.Background(), &actor.Actor{UID: 1})
result, err := (&Resolver{db: db}).AuthorizedUsers(ctx, &graphqlbackend.RepoAuthorizedUserArgs{})
if want := backend.ErrMustBeSiteAdmin; err != want {
if want := auth.ErrMustBeSiteAdmin; err != want {
t.Errorf("err: want %q but got %v", want, err)
}
if result != nil {
@ -1113,7 +1113,7 @@ func TestResolver_RepositoryPermissionsInfo(t *testing.T) {
ctx := actor.WithActor(context.Background(), &actor.Actor{UID: 1})
result, err := (&Resolver{db: db}).RepositoryPermissionsInfo(ctx, graphqlbackend.MarshalRepositoryID(1))
if want := backend.ErrMustBeSiteAdmin; err != want {
if want := auth.ErrMustBeSiteAdmin; err != want {
t.Errorf("err: want %q but got %v", want, err)
}
if result != nil {
@ -1198,7 +1198,7 @@ func TestResolver_UserPermissionsInfo(t *testing.T) {
ctx := actor.WithActor(context.Background(), &actor.Actor{UID: 1})
result, err := (&Resolver{db: db}).UserPermissionsInfo(ctx, graphqlbackend.MarshalRepositoryID(1))
if want := backend.ErrMustBeSiteAdmin; err != want {
if want := auth.ErrMustBeSiteAdmin; err != want {
t.Errorf("err: want %q but got %v", want, err)
}
if result != nil {
@ -1287,7 +1287,7 @@ func TestResolver_SetSubRepositoryPermissionsForUsers(t *testing.T) {
ctx := actor.WithActor(context.Background(), &actor.Actor{UID: 1})
result, err := (&Resolver{db: db}).SetSubRepositoryPermissionsForUsers(ctx, &graphqlbackend.SubRepoPermsArgs{})
if want := backend.ErrMustBeSiteAdmin; err != want {
if want := auth.ErrMustBeSiteAdmin; err != want {
t.Errorf("err: want %q but got %v", want, err)
}
if result != nil {
@ -1481,7 +1481,7 @@ func TestResolver_BitbucketProjectPermissionJobs(t *testing.T) {
ctx := actor.WithActor(context.Background(), &actor.Actor{UID: 1})
result, err := r.BitbucketProjectPermissionJobs(ctx, nil)
require.ErrorIs(t, err, backend.ErrMustBeSiteAdmin)
require.ErrorIs(t, err, auth.ErrMustBeSiteAdmin)
require.Nil(t, result)
})

8
enterprise/cmd/frontend/internal/authz/resolvers/users.go
View File

@ -6,9 +6,9 @@ import (
"github.com/graph-gophers/graphql-go"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/graphqlbackend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/graphqlbackend/graphqlutil"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/database"
"github.com/sourcegraph/sourcegraph/internal/types"
)
@ -94,7 +94,7 @@ func (r *userConnectionResolver) compute(ctx context.Context) ([]*types.User, *g
func (r *userConnectionResolver) Nodes(ctx context.Context) ([]*graphqlbackend.UserResolver, error) {
// 🚨 SECURITY: Only site admins may access this method.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}
@ -111,7 +111,7 @@ func (r *userConnectionResolver) Nodes(ctx context.Context) ([]*graphqlbackend.U
func (r *userConnectionResolver) TotalCount(ctx context.Context) (int32, error) {
// 🚨 SECURITY: Only site admins may access this method.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return -1, err
}
@ -120,7 +120,7 @@ func (r *userConnectionResolver) TotalCount(ctx context.Context) (int32, error)
func (r *userConnectionResolver) PageInfo(ctx context.Context) (*graphqlutil.PageInfo, error) {
// 🚨 SECURITY: Only site admins may access this method.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}

4
enterprise/cmd/frontend/internal/batches/resolvers/batch_change.go
View File

@ -10,13 +10,13 @@ import (
"github.com/graph-gophers/graphql-go"
"github.com/graph-gophers/graphql-go/relay"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/graphqlbackend"
"github.com/sourcegraph/sourcegraph/enterprise/internal/batches/service"
"github.com/sourcegraph/sourcegraph/enterprise/internal/batches/state"
"github.com/sourcegraph/sourcegraph/enterprise/internal/batches/store"
btypes "github.com/sourcegraph/sourcegraph/enterprise/internal/batches/types"
"github.com/sourcegraph/sourcegraph/internal/actor"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/errcode"
"github.com/sourcegraph/sourcegraph/lib/errors"
)
@ -333,7 +333,7 @@ func (r *batchChangeResolver) BatchSpecs(
opts.IncludeLocallyExecutedSpecs = *args.IncludeLocallyExecutedSpecs
}
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.store.DatabaseDB()); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.store.DatabaseDB()); err != nil {
opts.ExcludeCreatedFromRawNotOwnedByUser = actor.FromContext(ctx).UID
}

4
enterprise/cmd/frontend/internal/batches/resolvers/batch_spec.go
View File

@ -12,13 +12,13 @@ import (
"github.com/sourcegraph/go-diff/diff"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/graphqlbackend"
"github.com/sourcegraph/sourcegraph/enterprise/internal/batches/search"
"github.com/sourcegraph/sourcegraph/enterprise/internal/batches/service"
"github.com/sourcegraph/sourcegraph/enterprise/internal/batches/store"
btypes "github.com/sourcegraph/sourcegraph/enterprise/internal/batches/types"
"github.com/sourcegraph/sourcegraph/internal/actor"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/database"
"github.com/sourcegraph/sourcegraph/internal/errcode"
"github.com/sourcegraph/sourcegraph/lib/batches"
@ -278,7 +278,7 @@ func (r *batchSpecResolver) SupersedingBatchSpec(ctx context.Context) (graphqlba
func (r *batchSpecResolver) ViewerBatchChangesCodeHosts(ctx context.Context, args *graphqlbackend.ListViewerBatchChangesCodeHostsArgs) (graphqlbackend.BatchChangesCodeHostConnectionResolver, error) {
actor := actor.FromContext(ctx)
if !actor.IsAuthenticated() {
return nil, backend.ErrNotAuthenticated
return nil, auth.ErrNotAuthenticated
}
repoIDs, err := r.store.ListBatchSpecRepoIDs(ctx, r.batchSpec.ID)

6
enterprise/cmd/frontend/internal/batches/resolvers/batch_spec_workspace.go
View File

@ -8,10 +8,10 @@ import (
"github.com/graph-gophers/graphql-go"
"github.com/graph-gophers/graphql-go/relay"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/graphqlbackend"
"github.com/sourcegraph/sourcegraph/enterprise/internal/batches/store"
btypes "github.com/sourcegraph/sourcegraph/enterprise/internal/batches/types"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/errcode"
"github.com/sourcegraph/sourcegraph/internal/gitserver"
gql "github.com/sourcegraph/sourcegraph/internal/services/executors/transport/graphql"
@ -430,8 +430,8 @@ func (r *batchSpecWorkspaceResolver) Executor(ctx context.Context) (*gql.Executo
return nil, nil
}
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.store.DatabaseDB()); err != nil {
if err != backend.ErrMustBeSiteAdmin {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.store.DatabaseDB()); err != nil {
if err != auth.ErrMustBeSiteAdmin {
return nil, err
}
return nil, nil

8
enterprise/cmd/frontend/internal/batches/resolvers/changeset.go
View File

@ -10,7 +10,6 @@ import (
"github.com/graph-gophers/graphql-go"
"github.com/graph-gophers/graphql-go/relay"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/graphqlbackend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/graphqlbackend/externallink"
"github.com/sourcegraph/sourcegraph/enterprise/internal/batches/state"
@ -19,6 +18,7 @@ import (
btypes "github.com/sourcegraph/sourcegraph/enterprise/internal/batches/types"
"github.com/sourcegraph/sourcegraph/enterprise/internal/batches/types/scheduler/config"
"github.com/sourcegraph/sourcegraph/internal/actor"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/conf"
"github.com/sourcegraph/sourcegraph/internal/gitserver"
"github.com/sourcegraph/sourcegraph/internal/types"
@ -177,11 +177,11 @@ func (r *changesetResolver) BatchChanges(ctx context.Context, args *graphqlbacke
opts.Cursor = cursor
}
authErr := backend.CheckCurrentUserIsSiteAdmin(ctx, r.store.DatabaseDB())
if authErr != nil && authErr != backend.ErrMustBeSiteAdmin {
authErr := auth.CheckCurrentUserIsSiteAdmin(ctx, r.store.DatabaseDB())
if authErr != nil && authErr != auth.ErrMustBeSiteAdmin {
return nil, err
}
isSiteAdmin := authErr != backend.ErrMustBeSiteAdmin
isSiteAdmin := authErr != auth.ErrMustBeSiteAdmin
if !isSiteAdmin {
if args.ViewerCanAdminister != nil && *args.ViewerCanAdminister {
actor := actor.FromContext(ctx)

58
enterprise/cmd/frontend/internal/batches/resolvers/resolver.go
View File

@ -8,7 +8,6 @@ import (
"github.com/graph-gophers/graphql-go"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/enterprise"
"github.com/sourcegraph/sourcegraph/cmd/frontend/graphqlbackend"
"github.com/sourcegraph/sourcegraph/enterprise/internal/batches/search"
@ -18,12 +17,13 @@ import (
"github.com/sourcegraph/sourcegraph/enterprise/internal/licensing"
"github.com/sourcegraph/sourcegraph/internal/actor"
"github.com/sourcegraph/sourcegraph/internal/api"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/database"
"github.com/sourcegraph/sourcegraph/internal/deviceid"
"github.com/sourcegraph/sourcegraph/internal/encryption"
"github.com/sourcegraph/sourcegraph/internal/errcode"
"github.com/sourcegraph/sourcegraph/internal/extsvc"
"github.com/sourcegraph/sourcegraph/internal/extsvc/auth"
extsvcauth "github.com/sourcegraph/sourcegraph/internal/extsvc/auth"
"github.com/sourcegraph/sourcegraph/internal/extsvc/bitbucketserver"
"github.com/sourcegraph/sourcegraph/internal/featureflag"
"github.com/sourcegraph/sourcegraph/internal/trace"
@ -51,7 +51,7 @@ func batchChangesCreateAccess(ctx context.Context, db database.DB) error {
act := actor.FromContext(ctx)
if !act.IsAuthenticated() {
return backend.ErrNotAuthenticated
return auth.ErrNotAuthenticated
}
return nil
}
@ -223,7 +223,7 @@ func (r *Resolver) ResolveWorkspacesForBatchSpec(ctx context.Context, args *grap
// Verify the user is authenticated.
act := actor.FromContext(ctx)
if !act.IsAuthenticated() {
return nil, backend.ErrNotAuthenticated
return nil, auth.ErrNotAuthenticated
}
// Run the resolution.
@ -296,7 +296,7 @@ func (r *Resolver) changesetSpecByID(ctx context.Context, id graphql.ID) (graphq
type batchChangesCredentialResolver interface {
graphqlbackend.BatchChangesCredentialResolver
authenticator(ctx context.Context) (auth.Authenticator, error)
authenticator(ctx context.Context) (extsvcauth.Authenticator, error)
}
func (r *Resolver) batchChangesCredentialByID(ctx context.Context, id graphql.ID) (batchChangesCredentialResolver, error) {
@ -329,7 +329,7 @@ func (r *Resolver) batchChangesUserCredentialByID(ctx context.Context, id int64)
return nil, err
}
if err := backend.CheckSiteAdminOrSameUser(ctx, r.store.DatabaseDB(), cred.UserID); err != nil {
if err := auth.CheckSiteAdminOrSameUser(ctx, r.store.DatabaseDB(), cred.UserID); err != nil {
return nil, err
}
@ -338,7 +338,7 @@ func (r *Resolver) batchChangesUserCredentialByID(ctx context.Context, id int64)
func (r *Resolver) batchChangesSiteCredentialByID(ctx context.Context, id int64) (batchChangesCredentialResolver, error) {
// Todo: Is this required? Should everyone be able to see there are _some_ credentials?
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.store.DatabaseDB()); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.store.DatabaseDB()); err != nil {
return nil, err
}
@ -624,7 +624,7 @@ func (r *Resolver) CreateChangesetSpec(ctx context.Context, args *graphqlbackend
// To be extra safe, we'll just do the cheap check again here so if anyone ever modifies
// batchChangesCreateAccess, we still enforce it here.
if !act.IsAuthenticated() {
return nil, backend.ErrNotAuthenticated
return nil, auth.ErrNotAuthenticated
}
svc := service.New(r.store)
@ -752,11 +752,11 @@ func (r *Resolver) BatchChanges(ctx context.Context, args *graphqlbackend.ListBa
opts.Cursor = cursor
}
authErr := backend.CheckCurrentUserIsSiteAdmin(ctx, r.store.DatabaseDB())
if authErr != nil && authErr != backend.ErrMustBeSiteAdmin {
authErr := auth.CheckCurrentUserIsSiteAdmin(ctx, r.store.DatabaseDB())
if authErr != nil && authErr != auth.ErrMustBeSiteAdmin {
return nil, authErr
}
isSiteAdmin := authErr != backend.ErrMustBeSiteAdmin
isSiteAdmin := authErr != auth.ErrMustBeSiteAdmin
if !isSiteAdmin {
actor := actor.FromContext(ctx)
if args.ViewerCanAdminister != nil && *args.ViewerCanAdminister {
@ -822,7 +822,7 @@ func (r *Resolver) BatchChangesCodeHosts(ctx context.Context, args *graphqlbacke
if args.UserID != nil {
// 🚨 SECURITY: Only viewable for self or by site admins.
if err := backend.CheckSiteAdminOrSameUser(ctx, r.store.DatabaseDB(), *args.UserID); err != nil {
if err := auth.CheckSiteAdminOrSameUser(ctx, r.store.DatabaseDB(), *args.UserID); err != nil {
return nil, err
}
}
@ -1075,7 +1075,7 @@ func (r *Resolver) CreateBatchChangesCredential(ctx context.Context, args *graph
func (r *Resolver) createBatchChangesUserCredential(ctx context.Context, externalServiceURL, externalServiceType string, userID int32, credential string, username *string) (graphqlbackend.BatchChangesCredentialResolver, error) {
// 🚨 SECURITY: Check that the requesting user can create the credential.
if err := backend.CheckSiteAdminOrSameUser(ctx, r.store.DatabaseDB(), userID); err != nil {
if err := auth.CheckSiteAdminOrSameUser(ctx, r.store.DatabaseDB(), userID); err != nil {
return nil, err
}
@ -1109,7 +1109,7 @@ func (r *Resolver) createBatchChangesUserCredential(ctx context.Context, externa
func (r *Resolver) createBatchChangesSiteCredential(ctx context.Context, externalServiceURL, externalServiceType string, credential string, username *string) (graphqlbackend.BatchChangesCredentialResolver, error) {
// 🚨 SECURITY: Check that a site credential can only be created
// by a site-admin.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.store.DatabaseDB()); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.store.DatabaseDB()); err != nil {
return nil, err
}
@ -1140,10 +1140,10 @@ func (r *Resolver) createBatchChangesSiteCredential(ctx context.Context, externa
return &batchChangesSiteCredentialResolver{credential: cred}, nil
}
func (r *Resolver) generateAuthenticatorForCredential(ctx context.Context, externalServiceType, externalServiceURL, credential string, username *string) (auth.Authenticator, error) {
func (r *Resolver) generateAuthenticatorForCredential(ctx context.Context, externalServiceType, externalServiceURL, credential string, username *string) (extsvcauth.Authenticator, error) {
svc := service.New(r.store)
var a auth.Authenticator
var a extsvcauth.Authenticator
keypair, err := encryption.GenerateRSAKey()
if err != nil {
return nil, err
@ -1157,22 +1157,22 @@ func (r *Resolver) generateAuthenticatorForCredential(ctx context.Context, exter
}
return nil, err
}
a = &auth.BasicAuthWithSSH{
BasicAuth: auth.BasicAuth{Username: username, Password: credential},
a = &extsvcauth.BasicAuthWithSSH{
BasicAuth: extsvcauth.BasicAuth{Username: username, Password: credential},
PrivateKey: keypair.PrivateKey,
PublicKey: keypair.PublicKey,
Passphrase: keypair.Passphrase,
}
} else if externalServiceType == extsvc.TypeBitbucketCloud {
a = &auth.BasicAuthWithSSH{
BasicAuth: auth.BasicAuth{Username: *username, Password: credential},
a = &extsvcauth.BasicAuthWithSSH{
BasicAuth: extsvcauth.BasicAuth{Username: *username, Password: credential},
PrivateKey: keypair.PrivateKey,
PublicKey: keypair.PublicKey,
Passphrase: keypair.Passphrase,
}
} else {
a = &auth.OAuthBearerTokenWithSSH{
OAuthBearerToken: auth.OAuthBearerToken{Token: credential},
a = &extsvcauth.OAuthBearerTokenWithSSH{
OAuthBearerToken: extsvcauth.OAuthBearerToken{Token: credential},
PrivateKey: keypair.PrivateKey,
PublicKey: keypair.PublicKey,
Passphrase: keypair.Passphrase,
@ -1220,7 +1220,7 @@ func (r *Resolver) deleteBatchChangesUserCredential(ctx context.Context, credent
}
// 🚨 SECURITY: Check that the requesting user may delete the credential.
if err := backend.CheckSiteAdminOrSameUser(ctx, r.store.DatabaseDB(), cred.UserID); err != nil {
if err := auth.CheckSiteAdminOrSameUser(ctx, r.store.DatabaseDB(), cred.UserID); err != nil {
return nil, err
}
@ -1234,7 +1234,7 @@ func (r *Resolver) deleteBatchChangesUserCredential(ctx context.Context, credent
func (r *Resolver) deleteBatchChangesSiteCredential(ctx context.Context, credentialDBID int64) (*graphqlbackend.EmptyResponse, error) {
// 🚨 SECURITY: Check that the requesting user may delete the credential.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.store.DatabaseDB()); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.store.DatabaseDB()); err != nil {
return nil, err
}
@ -1496,7 +1496,7 @@ func (r *Resolver) BatchSpecs(ctx context.Context, args *graphqlbackend.ListBatc
// 🚨 SECURITY: If the user is not an admin, we don't want to include
// BatchSpecs that were created with CreateBatchSpecFromRaw and not owned
// by the user
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.store.DatabaseDB()); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.store.DatabaseDB()); err != nil {
opts.ExcludeCreatedFromRawNotOwnedByUser = actor.FromContext(ctx).UID
}
@ -1797,7 +1797,7 @@ func (r *Resolver) UpsertBatchSpecInput(ctx context.Context, args *graphqlbacken
func (r *Resolver) CancelBatchSpecWorkspaceExecution(ctx context.Context, args *graphqlbackend.CancelBatchSpecWorkspaceExecutionArgs) (*graphqlbackend.EmptyResponse, error) {
// TODO(ssbc): currently admin only.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.store.DatabaseDB()); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.store.DatabaseDB()); err != nil {
return nil, err
}
// TODO(ssbc): not implemented
@ -1839,7 +1839,7 @@ func (r *Resolver) RetryBatchSpecExecution(ctx context.Context, args *graphqlbac
func (r *Resolver) EnqueueBatchSpecWorkspaceExecution(ctx context.Context, args *graphqlbackend.EnqueueBatchSpecWorkspaceExecutionArgs) (*graphqlbackend.EmptyResponse, error) {
// TODO(ssbc): currently admin only.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.store.DatabaseDB()); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.store.DatabaseDB()); err != nil {
return nil, err
}
// TODO(ssbc): not implemented
@ -1848,7 +1848,7 @@ func (r *Resolver) EnqueueBatchSpecWorkspaceExecution(ctx context.Context, args
func (r *Resolver) ToggleBatchSpecAutoApply(ctx context.Context, args *graphqlbackend.ToggleBatchSpecAutoApplyArgs) (graphqlbackend.BatchSpecResolver, error) {
// TODO(ssbc): currently admin only.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.store.DatabaseDB()); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.store.DatabaseDB()); err != nil {
return nil, err
}
// TODO(ssbc): not implemented
@ -1857,7 +1857,7 @@ func (r *Resolver) ToggleBatchSpecAutoApply(ctx context.Context, args *graphqlba
func (r *Resolver) DeleteBatchSpec(ctx context.Context, args *graphqlbackend.DeleteBatchSpecArgs) (*graphqlbackend.EmptyResponse, error) {
// TODO(ssbc): currently admin only.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.store.DatabaseDB()); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.store.DatabaseDB()); err != nil {
return nil, err
}
// TODO(ssbc): not implemented

6
enterprise/cmd/frontend/internal/codemonitors/resolvers/resolvers.go
View File

@ -9,12 +9,12 @@ import (
"github.com/graph-gophers/graphql-go/relay"
"github.com/sourcegraph/log"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/graphqlbackend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/graphqlbackend/graphqlutil"
"github.com/sourcegraph/sourcegraph/enterprise/internal/codemonitors"
"github.com/sourcegraph/sourcegraph/enterprise/internal/codemonitors/background"
edb "github.com/sourcegraph/sourcegraph/enterprise/internal/database"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/database"
"github.com/sourcegraph/sourcegraph/internal/featureflag"
"github.com/sourcegraph/sourcegraph/internal/httpcli"
@ -352,7 +352,7 @@ func (r *Resolver) createRecipients(ctx context.Context, emailID int64, recipien
// actions (emails, webhooks) immediately. This is useful during development and
// troubleshooting. Only site admins can call this functions.
func (r *Resolver) ResetTriggerQueryTimestamps(ctx context.Context, args *graphqlbackend.ResetTriggerQueryTimestampsArgs) (*graphqlbackend.EmptyResponse, error) {
err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db)
err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db)
if err != nil {
return nil, err
}
@ -673,7 +673,7 @@ func (r *Resolver) isAllowedToCreate(ctx context.Context, owner graphql.ID) erro
}
switch kind := relay.UnmarshalKind(owner); kind {
case "User":
return backend.CheckSiteAdminOrSameUser(ctx, r.db, ownerInt32)
return auth.CheckSiteAdminOrSameUser(ctx, r.db, ownerInt32)
case "Org":
return errors.Errorf("creating a code monitor with an org namespace is no longer supported")
default:

8
enterprise/cmd/frontend/internal/dotcom/productsubscription/licenses_graphql.go
View File

@ -10,11 +10,11 @@ import (
"github.com/sourcegraph/log"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/graphqlbackend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/graphqlbackend/graphqlutil"
"github.com/sourcegraph/sourcegraph/enterprise/internal/license"
"github.com/sourcegraph/sourcegraph/enterprise/internal/licensing"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/database"
)
@ -55,7 +55,7 @@ func productLicenseByDBID(ctx context.Context, logger log.Logger, db database.DB
if err != nil {
return nil, err
}
if err := backend.CheckSiteAdminOrSameUser(ctx, db, sub.v.UserID); err != nil {
if err := auth.CheckSiteAdminOrSameUser(ctx, db, sub.v.UserID); err != nil {
return nil, err
}
@ -116,7 +116,7 @@ func generateProductLicenseForSubscription(ctx context.Context, db database.DB,
func (r ProductSubscriptionLicensingResolver) GenerateProductLicenseForSubscription(ctx context.Context, args *graphqlbackend.GenerateProductLicenseForSubscriptionArgs) (graphqlbackend.ProductLicense, error) {
// 🚨 SECURITY: Only site admins may generate product licenses.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.DB); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.DB); err != nil {
return nil, err
}
sub, err := productSubscriptionByID(ctx, r.logger, r.DB, args.ProductSubscriptionID)
@ -132,7 +132,7 @@ func (r ProductSubscriptionLicensingResolver) GenerateProductLicenseForSubscript
func (r ProductSubscriptionLicensingResolver) ProductLicenses(ctx context.Context, args *graphqlbackend.ProductLicensesArgs) (graphqlbackend.ProductLicenseConnection, error) {
// 🚨 SECURITY: Only site admins may list product licenses.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.DB); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.DB); err != nil {
return nil, err
}

18
enterprise/cmd/frontend/internal/dotcom/productsubscription/subscriptions_graphql.go
View File

@ -11,9 +11,9 @@ import (
"github.com/sourcegraph/log"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/graphqlbackend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/graphqlbackend/graphqlutil"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/database"
"github.com/sourcegraph/sourcegraph/internal/errcode"
)
@ -48,7 +48,7 @@ func productSubscriptionByDBID(ctx context.Context, logger log.Logger, db databa
return nil, err
}
// 🚨 SECURITY: Only site admins and the subscription account's user may view a product subscription.
if err := backend.CheckSiteAdminOrSameUser(ctx, db, v.UserID); err != nil {
if err := auth.CheckSiteAdminOrSameUser(ctx, db, v.UserID); err != nil {
return nil, err
}
return &productSubscription{v: v, db: db}, nil
@ -107,7 +107,7 @@ func (r *productSubscription) ActiveLicense(ctx context.Context) (graphqlbackend
func (r *productSubscription) ProductLicenses(ctx context.Context, args *graphqlutil.ConnectionArgs) (graphqlbackend.ProductLicenseConnection, error) {
// 🚨 SECURITY: Only site admins may list historical product licenses (to reduce confusion
// around old license reuse). Other viewers should use ProductSubscription.activeLicense.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil, err
}
@ -133,7 +133,7 @@ func (r *productSubscription) URL(ctx context.Context) (string, error) {
func (r *productSubscription) URLForSiteAdmin(ctx context.Context) *string {
// 🚨 SECURITY: Only site admins may see this URL. Currently it does not contain any sensitive
// info, but there is no need to show it to non-site admins.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.db); err != nil {
return nil
}
u := fmt.Sprintf("/site-admin/dotcom/product/subscriptions/%s", r.v.ID)
@ -142,7 +142,7 @@ func (r *productSubscription) URLForSiteAdmin(ctx context.Context) *string {
func (r ProductSubscriptionLicensingResolver) CreateProductSubscription(ctx context.Context, args *graphqlbackend.CreateProductSubscriptionArgs) (graphqlbackend.ProductSubscription, error) {
// 🚨 SECURITY: Only site admins may create product subscriptions.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.DB); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.DB); err != nil {
return nil, err
}
@ -159,7 +159,7 @@ func (r ProductSubscriptionLicensingResolver) CreateProductSubscription(ctx cont
func (r ProductSubscriptionLicensingResolver) ArchiveProductSubscription(ctx context.Context, args *graphqlbackend.ArchiveProductSubscriptionArgs) (*graphqlbackend.EmptyResponse, error) {
// 🚨 SECURITY: Only site admins may archive product subscriptions.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.DB); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.DB); err != nil {
return nil, err
}
@ -192,11 +192,11 @@ func (r ProductSubscriptionLicensingResolver) ProductSubscriptions(ctx context.C
// 🚨 SECURITY: Users may only list their own product subscriptions. Site admins may list
// licenses for all users, or for any other user.
if accountUser == nil {
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.DB); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.DB); err != nil {
return nil, err
}
} else {
if err := backend.CheckSiteAdminOrSameUser(ctx, r.DB, accountUser.DatabaseID()); err != nil {
if err := auth.CheckSiteAdminOrSameUser(ctx, r.DB, accountUser.DatabaseID()); err != nil {
return nil, err
}
}
@ -210,7 +210,7 @@ func (r ProductSubscriptionLicensingResolver) ProductSubscriptions(ctx context.C
// 🚨 SECURITY: Only site admins may query or view license for all users, or for any other user.
// Note this check is currently repetitive with the check above. However, it is duplicated here to
// ensure it remains in effect if the code path above chagnes.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.DB); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.DB); err != nil {
return nil, err
}
opt.Query = *args.Query

6
enterprise/cmd/frontend/internal/registry/extension_graphql.go
View File

@ -7,10 +7,10 @@ import (
"github.com/graph-gophers/graphql-go"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/graphqlbackend"
registry "github.com/sourcegraph/sourcegraph/cmd/frontend/registry/api"
"github.com/sourcegraph/sourcegraph/enterprise/cmd/frontend/internal/registry/stores"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/database"
"github.com/sourcegraph/sourcegraph/lib/errors"
)
@ -90,10 +90,10 @@ func (r *extensionDBResolver) IsWorkInProgress() bool {
func (r *extensionDBResolver) ViewerCanAdminister(ctx context.Context) (bool, error) {
err := toRegistryPublisherID(r.v).viewerCanAdminister(ctx, r.db)
if err == backend.ErrMustBeSiteAdmin || err == backend.ErrNotAnOrgMember || err == backend.ErrNotAuthenticated {
if err == auth.ErrMustBeSiteAdmin || err == auth.ErrNotAnOrgMember || err == auth.ErrNotAuthenticated {
return false, nil
}
if errors.HasType(err, &backend.InsufficientAuthorizationError{}) {
if errors.HasType(err, &auth.InsufficientAuthorizationError{}) {
return false, nil
}
return err == nil, err

6
enterprise/cmd/frontend/internal/registry/publisher_graphql.go
View File

@ -6,11 +6,11 @@ import (
"github.com/graph-gophers/graphql-go"
"github.com/graph-gophers/graphql-go/relay"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/graphqlbackend"
frontendregistry "github.com/sourcegraph/sourcegraph/cmd/frontend/registry/api"
"github.com/sourcegraph/sourcegraph/enterprise/cmd/frontend/internal/registry/stores"
"github.com/sourcegraph/sourcegraph/enterprise/internal/licensing"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/database"
"github.com/sourcegraph/sourcegraph/lib/errors"
)
@ -139,10 +139,10 @@ func (p *registryPublisherID) viewerCanAdminister(ctx context.Context, db databa
switch {
case p.userID != 0:
// 🚨 SECURITY: Check that the current user is either the publisher or a site admin.
return backend.CheckSiteAdminOrSameUser(ctx, db, p.userID)
return auth.CheckSiteAdminOrSameUser(ctx, db, p.userID)
case p.orgID != 0:
// 🚨 SECURITY: Check that the current user is a member of the publisher org.
return backend.CheckOrgAccessOrSiteAdmin(ctx, db, p.orgID)
return auth.CheckOrgAccessOrSiteAdmin(ctx, db, p.orgID)
default:
return errRegistryUnknownPublisher
}

26
enterprise/internal/batches/service/service.go
View File

@ -12,16 +12,16 @@ import (
sglog "github.com/sourcegraph/log"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/enterprise/internal/batches/global"
"github.com/sourcegraph/sourcegraph/enterprise/internal/batches/sources"
"github.com/sourcegraph/sourcegraph/enterprise/internal/batches/store"
btypes "github.com/sourcegraph/sourcegraph/enterprise/internal/batches/types"
"github.com/sourcegraph/sourcegraph/internal/actor"
"github.com/sourcegraph/sourcegraph/internal/api"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/database"
"github.com/sourcegraph/sourcegraph/internal/errcode"
"github.com/sourcegraph/sourcegraph/internal/extsvc/auth"
extsvcauth "github.com/sourcegraph/sourcegraph/internal/extsvc/auth"
"github.com/sourcegraph/sourcegraph/internal/httpcli"
"github.com/sourcegraph/sourcegraph/internal/metrics"
"github.com/sourcegraph/sourcegraph/internal/observation"
@ -922,7 +922,7 @@ func (s *Service) MoveBatchChange(ctx context.Context, opts MoveBatchChangeOpts)
}
// 🚨 SECURITY: Only the Author of the batch change can move it.
if err := backend.CheckSiteAdminOrSameUser(ctx, s.store.DatabaseDB(), batchChange.CreatorID); err != nil {
if err := auth.CheckSiteAdminOrSameUser(ctx, s.store.DatabaseDB(), batchChange.CreatorID); err != nil {
return nil, err
}
// Check if current user has access to target namespace if set.
@ -962,7 +962,7 @@ func (s *Service) CloseBatchChange(ctx context.Context, id int64, closeChangeset
return batchChange, nil
}
if err := backend.CheckSiteAdminOrSameUser(ctx, s.store.DatabaseDB(), batchChange.CreatorID); err != nil {
if err := auth.CheckSiteAdminOrSameUser(ctx, s.store.DatabaseDB(), batchChange.CreatorID); err != nil {
return nil, err
}
@ -1004,7 +1004,7 @@ func (s *Service) DeleteBatchChange(ctx context.Context, id int64) (err error) {
return err
}
if err := backend.CheckSiteAdminOrSameUser(ctx, s.store.DatabaseDB(), batchChange.CreatorID); err != nil {
if err := auth.CheckSiteAdminOrSameUser(ctx, s.store.DatabaseDB(), batchChange.CreatorID); err != nil {
return err
}
@ -1042,7 +1042,7 @@ func (s *Service) EnqueueChangesetSync(ctx context.Context, id int64) (err error
)
for _, c := range batchChanges {
err := backend.CheckSiteAdminOrSameUser(ctx, s.store.DatabaseDB(), c.CreatorID)
err := auth.CheckSiteAdminOrSameUser(ctx, s.store.DatabaseDB(), c.CreatorID)
if err != nil {
authErr = err
} else {
@ -1093,7 +1093,7 @@ func (s *Service) ReenqueueChangeset(ctx context.Context, id int64) (changeset *
)
for _, c := range attachedBatchChanges {
err := backend.CheckSiteAdminOrSameUser(ctx, s.store.DatabaseDB(), c.CreatorID)
err := auth.CheckSiteAdminOrSameUser(ctx, s.store.DatabaseDB(), c.CreatorID)
if err != nil {
authErr = err
} else {
@ -1132,7 +1132,7 @@ func (s *Service) CheckNamespaceAccess(ctx context.Context, namespaceUserID, nam
// error in that case.
func (s *Service) CanAdministerInNamespace(ctx context.Context, namespaceUserID, namespaceOrgID int32) (bool, error) {
err := s.CheckNamespaceAccess(ctx, namespaceUserID, namespaceOrgID)
if err != nil && (err == backend.ErrNotAnOrgMember || errcode.IsUnauthorized(err)) {
if err != nil && (err == auth.ErrNotAnOrgMember || errcode.IsUnauthorized(err)) {
// These errors indicate that the viewer is valid, but that they simply
// don't have access to administer this batch change. We don't want to
// propagate that error to the caller.
@ -1143,9 +1143,9 @@ func (s *Service) CanAdministerInNamespace(ctx context.Context, namespaceUserID,
func (s *Service) checkNamespaceAccessWithDB(ctx context.Context, db database.DB, namespaceUserID, namespaceOrgID int32) (err error) {
if namespaceOrgID != 0 {
return backend.CheckOrgAccessOrSiteAdmin(ctx, db, namespaceOrgID)
return auth.CheckOrgAccessOrSiteAdmin(ctx, db, namespaceOrgID)
} else if namespaceUserID != 0 {
return backend.CheckSiteAdminOrSameUser(ctx, db, namespaceUserID)
return auth.CheckSiteAdminOrSameUser(ctx, db, namespaceUserID)
} else {
return ErrNoNamespace
}
@ -1171,7 +1171,7 @@ func (s *Service) FetchUsernameForBitbucketServerToken(ctx context.Context, exte
defer endObservation(1, observation.Args{})
// Get a changeset source for the external service and use the given authenticator.
css, err := s.sourcer.ForExternalService(ctx, s.store, &auth.OAuthBearerToken{Token: token}, store.GetExternalServiceIDsOpts{
css, err := s.sourcer.ForExternalService(ctx, s.store, &extsvcauth.OAuthBearerToken{Token: token}, store.GetExternalServiceIDsOpts{
ExternalServiceType: externalServiceType,
ExternalServiceID: externalServiceID,
})
@ -1201,7 +1201,7 @@ var _ usernameSource = &sources.BitbucketServerSource{}
// ValidateAuthenticator creates a ChangesetSource, configures it with the given
// authenticator and validates it can correctly access the remote server.
func (s *Service) ValidateAuthenticator(ctx context.Context, externalServiceID, externalServiceType string, a auth.Authenticator) (err error) {
func (s *Service) ValidateAuthenticator(ctx context.Context, externalServiceID, externalServiceType string, a extsvcauth.Authenticator) (err error) {
ctx, _, endObservation := s.operations.validateAuthenticator.With(ctx, &err, observation.Args{})
defer endObservation(1, observation.Args{})
@ -1244,7 +1244,7 @@ func (s *Service) CreateChangesetJobs(ctx context.Context, batchChangeID int64,
}
// 🚨 SECURITY: Only the author of the batch change can create jobs.
if err := backend.CheckSiteAdminOrSameUser(ctx, s.store.DatabaseDB(), batchChange.CreatorID); err != nil {
if err := auth.CheckSiteAdminOrSameUser(ctx, s.store.DatabaseDB(), batchChange.CreatorID); err != nil {
return bulkGroupID, err
}

4
enterprise/internal/batches/service/service_apply_batch_change.go
View File

@ -4,11 +4,11 @@ import (
"context"
"fmt"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/enterprise/internal/batches/rewirer"
"github.com/sourcegraph/sourcegraph/enterprise/internal/batches/store"
btypes "github.com/sourcegraph/sourcegraph/enterprise/internal/batches/types"
"github.com/sourcegraph/sourcegraph/internal/actor"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/database/locker"
"github.com/sourcegraph/sourcegraph/internal/observation"
"github.com/sourcegraph/sourcegraph/lib/errors"
@ -64,7 +64,7 @@ func (s *Service) ApplyBatchChange(
}
// 🚨 SECURITY: Only site-admins or the creator of batchSpec can apply it.
if err := backend.CheckSiteAdminOrSameUser(ctx, s.store.DatabaseDB(), batchSpec.UserID); err != nil {
if err := auth.CheckSiteAdminOrSameUser(ctx, s.store.DatabaseDB(), batchSpec.UserID); err != nil {
return nil, err
}

16
enterprise/internal/batches/service/service_test.go
View File

@ -14,7 +14,6 @@ import (
"github.com/sourcegraph/log/logtest"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/graphqlbackend"
stesting "github.com/sourcegraph/sourcegraph/enterprise/internal/batches/sources/testing"
"github.com/sourcegraph/sourcegraph/enterprise/internal/batches/store"
@ -22,11 +21,12 @@ import (
btypes "github.com/sourcegraph/sourcegraph/enterprise/internal/batches/types"
"github.com/sourcegraph/sourcegraph/internal/actor"
"github.com/sourcegraph/sourcegraph/internal/api"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/database"
"github.com/sourcegraph/sourcegraph/internal/database/dbtest"
"github.com/sourcegraph/sourcegraph/internal/errcode"
"github.com/sourcegraph/sourcegraph/internal/extsvc"
"github.com/sourcegraph/sourcegraph/internal/extsvc/auth"
extsvcauth "github.com/sourcegraph/sourcegraph/internal/extsvc/auth"
"github.com/sourcegraph/sourcegraph/internal/extsvc/github"
"github.com/sourcegraph/sourcegraph/internal/observation"
"github.com/sourcegraph/sourcegraph/internal/repoupdater"
@ -538,7 +538,7 @@ func TestService(t *testing.T) {
}
_, err := svc.CreateBatchSpec(userCtx, opts)
if have, want := err, backend.ErrNotAnOrgMember; have != want {
if have, want := err, auth.ErrNotAnOrgMember; have != want {
t.Fatalf("expected %s error but got %s", want, have)
}
@ -774,7 +774,7 @@ index e5af166..d44c3fc 100644
opts := MoveBatchChangeOpts{BatchChangeID: batchChange.ID, NewNamespaceOrgID: orgID}
_, err := svc.MoveBatchChange(userCtx, opts)
if have, want := err, backend.ErrNotAnOrgMember; !errors.Is(have, want) {
if have, want := err, auth.ErrNotAnOrgMember; !errors.Is(have, want) {
t.Fatalf("expected %s error but got %s", want, have)
}
})
@ -904,7 +904,7 @@ index e5af166..d44c3fc 100644
ctx,
"https://github.com/",
extsvc.TypeGitHub,
&auth.OAuthBearerToken{Token: "test123"},
&extsvcauth.OAuthBearerToken{Token: "test123"},
); err != nil {
t.Fatal(err)
}
@ -919,7 +919,7 @@ index e5af166..d44c3fc 100644
ctx,
"https://github.com/",
extsvc.TypeGitHub,
&auth.OAuthBearerToken{Token: "test123"},
&extsvcauth.OAuthBearerToken{Token: "test123"},
); err == nil {
t.Fatal("unexpected nil-error returned from ValidateAuthenticator")
}
@ -3004,7 +3004,7 @@ func assertAuthError(t *testing.T, err error) {
t.Fatalf("expected error. got none")
}
if err != nil {
if !errors.HasType(err, &backend.InsufficientAuthorizationError{}) {
if !errors.HasType(err, &auth.InsufficientAuthorizationError{}) {
t.Fatalf("wrong error: %s (%T)", err, err)
}
}
@ -3014,7 +3014,7 @@ func assertNoAuthError(t *testing.T, err error) {
t.Helper()
// Ignore other errors, we only want to check whether it's an auth error
if errors.HasType(err, &backend.InsufficientAuthorizationError{}) {
if errors.HasType(err, &auth.InsufficientAuthorizationError{}) {
t.Fatalf("got auth error")
}
}

6
enterprise/internal/insights/resolvers/admin_resolver.go
View File

@ -3,12 +3,12 @@ package resolvers
import (
"context"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/graphqlbackend"
"github.com/sourcegraph/sourcegraph/enterprise/internal/insights/background/queryrunner"
"github.com/sourcegraph/sourcegraph/enterprise/internal/insights/store"
"github.com/sourcegraph/sourcegraph/enterprise/internal/insights/types"
"github.com/sourcegraph/sourcegraph/internal/actor"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/lib/errors"
)
@ -18,7 +18,7 @@ var _ graphqlbackend.InsightSeriesQueryStatusResolver = &insightSeriesQueryStatu
func (r *Resolver) UpdateInsightSeries(ctx context.Context, args *graphqlbackend.UpdateInsightSeriesArgs) (graphqlbackend.InsightSeriesMetadataPayloadResolver, error) {
actr := actor.FromContext(ctx)
if err := backend.CheckUserIsSiteAdmin(ctx, r.postgresDB, actr.UID); err != nil {
if err := auth.CheckUserIsSiteAdmin(ctx, r.postgresDB, actr.UID); err != nil {
return nil, err
}
@ -41,7 +41,7 @@ func (r *Resolver) UpdateInsightSeries(ctx context.Context, args *graphqlbackend
func (r *Resolver) InsightSeriesQueryStatus(ctx context.Context) ([]graphqlbackend.InsightSeriesQueryStatusResolver, error) {
actr := actor.FromContext(ctx)
if err := backend.CheckUserIsSiteAdmin(ctx, r.postgresDB, actr.UID); err != nil {
if err := auth.CheckUserIsSiteAdmin(ctx, r.postgresDB, actr.UID); err != nil {
return nil, err
}

17
cmd/frontend/backend/orgs.go → internal/auth/orgs.go
View File

@ -1,9 +1,8 @@
package backend
package auth
import (
"context"
"github.com/sourcegraph/sourcegraph/cmd/frontend/envvar"
"github.com/sourcegraph/sourcegraph/internal/actor"
"github.com/sourcegraph/sourcegraph/internal/database"
"github.com/sourcegraph/sourcegraph/internal/errcode"
@ -13,17 +12,13 @@ import (
var ErrNotAuthenticated = errors.New("not authenticated")
// CheckOrgAccessOrSiteAdmin returns an error if:
// (1) if we are on Cloud instance and the user is not a member of the organization
// (2) if we are NOT on Cloud and
//
// (a) the user is not a member of the organization
// (b) the user is not a site admin
// (1) the user is not a member of the organization
// (2) the user is not a site admin
//
// It is used when an action on an org can only be performed by the
// organization's members, (or site-admins - not on Cloud).
// organization's members, or site-admins.
func CheckOrgAccessOrSiteAdmin(ctx context.Context, db database.DB, orgID int32) error {
allowAdmin := !envvar.SourcegraphDotComMode()
return checkOrgAccess(ctx, db, orgID, allowAdmin)
return checkOrgAccess(ctx, db, orgID, true)
}
// CheckOrgAccess returns an error if the user is not a member of the
@ -36,7 +31,7 @@ func CheckOrgAccess(ctx context.Context, db database.DB, orgID int32) error {
}
// checkOrgAccess is a helper method used above which allows optionally allowing
// site admins to access all organisations.
// site admins to access all organizations.
func checkOrgAccess(ctx context.Context, db database.DB, orgID int32, allowAdmin bool) error {
if actor.FromContext(ctx).IsInternal() {
return nil

2
cmd/frontend/backend/site_admin.go → internal/auth/site_admin.go
View File

@ -1,4 +1,4 @@
package backend
package auth
import (
"context"

8
internal/codeintel/autoindexing/transport/graphql/root_resolver.go
View File

@ -8,9 +8,9 @@ import (
"github.com/graph-gophers/graphql-go"
"github.com/opentracing/opentracing-go/log"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/internal/actor"
"github.com/sourcegraph/sourcegraph/internal/api"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/codeintel/autoindexing/shared"
sharedresolvers "github.com/sourcegraph/sourcegraph/internal/codeintel/shared/resolvers"
"github.com/sourcegraph/sourcegraph/internal/conf"
@ -92,7 +92,7 @@ func (r *rootResolver) DeleteLSIFIndex(ctx context.Context, args *struct{ ID gra
}})
defer endObservation(1, observation.Args{})
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.autoindexSvc.GetUnsafeDB()); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.autoindexSvc.GetUnsafeDB()); err != nil {
return nil, err
}
if !autoIndexingEnabled() {
@ -205,7 +205,7 @@ func (r *rootResolver) QueueAutoIndexJobsForRepo(ctx context.Context, args *Queu
}})
endObservation.OnCancel(ctx, 1, observation.Args{})
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.autoindexSvc.GetUnsafeDB()); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.autoindexSvc.GetUnsafeDB()); err != nil {
return nil, err
}
if !autoIndexingEnabled() {
@ -259,7 +259,7 @@ func (r *rootResolver) UpdateRepositoryIndexConfiguration(ctx context.Context, a
}})
defer endObservation(1, observation.Args{})
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.autoindexSvc.GetUnsafeDB()); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.autoindexSvc.GetUnsafeDB()); err != nil {
return nil, err
}
if !autoIndexingEnabled() {

6
internal/codeintel/autoindexing/transport/graphql/root_resolver_test.go
View File

@ -9,7 +9,7 @@ import (
"github.com/sourcegraph/log/logtest"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/database"
"github.com/sourcegraph/sourcegraph/internal/observation"
"github.com/sourcegraph/sourcegraph/internal/types"
@ -58,7 +58,7 @@ func TestDeleteLSIFIndexUnauthenticated(t *testing.T) {
rootResolver := NewRootResolver(mockAutoIndexingService, mockUploadsService, mockPolicyService, &observation.TestContext)
if _, err := rootResolver.DeleteLSIFIndex(context.Background(), &struct{ ID graphql.ID }{id}); err != backend.ErrNotAuthenticated {
t.Errorf("unexpected error. want=%q have=%q", backend.ErrNotAuthenticated, err)
if _, err := rootResolver.DeleteLSIFIndex(context.Background(), &struct{ ID graphql.ID }{id}); err != auth.ErrNotAuthenticated {
t.Errorf("unexpected error. want=%q have=%q", auth.ErrNotAuthenticated, err)
}
}

7
internal/codeintel/policies/transport/graphql/root_resolver.go
View File

@ -12,6 +12,7 @@ import (
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/graphqlbackend/graphqlutil"
"github.com/sourcegraph/sourcegraph/internal/api"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/codeintel/policies"
sharedresolvers "github.com/sourcegraph/sourcegraph/internal/codeintel/shared/resolvers"
"github.com/sourcegraph/sourcegraph/internal/codeintel/types"
@ -143,7 +144,7 @@ func (r *rootResolver) CreateCodeIntelligenceConfigurationPolicy(ctx context.Con
ctx, traceErrs, endObservation := r.operations.createConfigurationPolicy.WithErrors(ctx, &err, observation.Args{LogFields: []log.Field{}})
endObservation.OnCancel(ctx, 1, observation.Args{})
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.policySvc.GetUnsafeDB()); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.policySvc.GetUnsafeDB()); err != nil {
return nil, err
}
@ -196,7 +197,7 @@ func (r *rootResolver) UpdateCodeIntelligenceConfigurationPolicy(ctx context.Con
}})
defer endObservation(1, observation.Args{})
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.policySvc.GetUnsafeDB()); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.policySvc.GetUnsafeDB()); err != nil {
return nil, err
}
@ -240,7 +241,7 @@ func (r *rootResolver) DeleteCodeIntelligenceConfigurationPolicy(ctx context.Con
}})
endObservation.OnCancel(ctx, 1, observation.Args{})
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.policySvc.GetUnsafeDB()); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.policySvc.GetUnsafeDB()); err != nil {
return nil, err
}

6
internal/codeintel/shared/resolvers/execution_log_entry_resolver.go
View File

@ -3,7 +3,7 @@ package sharedresolvers
import (
"context"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/workerutil"
)
@ -53,8 +53,8 @@ func (r *executionLogEntryResolver) DurationMilliseconds() *int32 {
func (r *executionLogEntryResolver) Out(ctx context.Context) (string, error) {
// 🚨 SECURITY: Only site admins can view executor log contents.
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.svc.GetUnsafeDB()); err != nil {
if err != backend.ErrMustBeSiteAdmin {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.svc.GetUnsafeDB()); err != nil {
if err != auth.ErrMustBeSiteAdmin {
return "", err
}

6
internal/codeintel/uploads/transport/graphql/root_resolver.go
View File

@ -7,7 +7,7 @@ import (
"github.com/opentracing/opentracing-go/log"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/internal/auth"
sharedresolvers "github.com/sourcegraph/sourcegraph/internal/codeintel/shared/resolvers"
"github.com/sourcegraph/sourcegraph/internal/observation"
)
@ -138,7 +138,7 @@ func (r *rootResolver) DeleteLSIFUpload(ctx context.Context, args *struct{ ID gr
}})
endObservation.OnCancel(ctx, 1, observation.Args{})
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.autoindexSvc.GetUnsafeDB()); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.autoindexSvc.GetUnsafeDB()); err != nil {
return nil, err
}
@ -159,7 +159,7 @@ func (r *rootResolver) DeleteLSIFUploads(ctx context.Context, args *DeleteLSIFUp
ctx, _, endObservation := r.operations.deleteLsifUploads.With(ctx, &err, observation.Args{})
endObservation.OnCancel(ctx, 1, observation.Args{})
if err := backend.CheckCurrentUserIsSiteAdmin(ctx, r.autoindexSvc.GetUnsafeDB()); err != nil {
if err := auth.CheckCurrentUserIsSiteAdmin(ctx, r.autoindexSvc.GetUnsafeDB()); err != nil {
return nil, err
}

6
internal/codeintel/uploads/transport/graphql/root_resolver_test.go
View File

@ -8,7 +8,7 @@ import (
"github.com/graph-gophers/graphql-go"
"github.com/sourcegraph/log/logtest"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/database"
"github.com/sourcegraph/sourcegraph/internal/observation"
"github.com/sourcegraph/sourcegraph/internal/types"
@ -55,7 +55,7 @@ func TestDeleteLSIFUploadUnauthenticated(t *testing.T) {
rootResolver := NewRootResolver(mockUploadService, mockAutoIndexingService, mockPolicyService, &observation.TestContext)
if _, err := rootResolver.DeleteLSIFUpload(context.Background(), &struct{ ID graphql.ID }{id}); err != backend.ErrNotAuthenticated {
t.Errorf("unexpected error. want=%q have=%q", backend.ErrNotAuthenticated, err)
if _, err := rootResolver.DeleteLSIFUpload(context.Background(), &struct{ ID graphql.ID }{id}); err != auth.ErrNotAuthenticated {
t.Errorf("unexpected error. want=%q have=%q", auth.ErrNotAuthenticated, err)
}
}

4
internal/search/alert/observer.go
View File

@ -9,8 +9,8 @@ import (
"github.com/sourcegraph/log"
"github.com/sourcegraph/zoekt"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/envvar"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/authz"
"github.com/sourcegraph/sourcegraph/internal/comby"
"github.com/sourcegraph/sourcegraph/internal/database"
@ -80,7 +80,7 @@ func (o *Observer) alertForNoResolvedRepos(ctx context.Context, q query.Q) *sear
}
}
isSiteAdmin := backend.CheckCurrentUserIsSiteAdmin(ctx, o.Db) == nil
isSiteAdmin := auth.CheckCurrentUserIsSiteAdmin(ctx, o.Db) == nil
if !envvar.SourcegraphDotComMode() {
if needsRepoConfig, err := needsRepositoryConfiguration(ctx, o.Db); err == nil && needsRepoConfig {
if isSiteAdmin {

4
internal/search/searchcontexts/search_contexts.go
View File

@ -11,10 +11,10 @@ import (
"golang.org/x/sync/errgroup"
"golang.org/x/sync/semaphore"
"github.com/sourcegraph/sourcegraph/cmd/frontend/backend"
"github.com/sourcegraph/sourcegraph/cmd/frontend/envvar"
"github.com/sourcegraph/sourcegraph/internal/actor"
"github.com/sourcegraph/sourcegraph/internal/api"
"github.com/sourcegraph/sourcegraph/internal/auth"
"github.com/sourcegraph/sourcegraph/internal/conf"
"github.com/sourcegraph/sourcegraph/internal/database"
"github.com/sourcegraph/sourcegraph/internal/errcode"
@ -122,7 +122,7 @@ func ValidateSearchContextWriteAccessForCurrentUser(ctx context.Context, db data
return errors.New("namespaceUserID and namespaceOrgID are mutually exclusive")
}
user, err := backend.CurrentUser(ctx, db)
user, err := auth.CurrentUser(ctx, db)
if err != nil {
return err
}