fix: check permission on keys before create/update

core/servicedata/service.go

@@ -95,7 +95,7 @@ func (s Service) CreateKey(ctx context.Context, key Key) (Key, error) {
 	key.ProjectSlug = prj.Slug
 
 	// create URN
-	key.URN = key.CreateURN()
+	key.URN = CreateURN(key.ProjectSlug, key.Name)
 
 	// Transaction for postgres repository
 	// TODO find way to use transaction for spicedb
@@ -160,6 +160,10 @@ func (s Service) CreateKey(ctx context.Context, key Key) (Key, error) {
 	return createdServiceDataKey, nil
 }
 
+func (s Service) GetKeyByURN(ctx context.Context, urn string) (Key, error) {
+	return s.repository.GetKeyByURN(ctx, urn)
+}
+
 func (s Service) Upsert(ctx context.Context, sd ServiceData) (ServiceData, error) {
 	if sd.Key.Name == "" {
 		return ServiceData{}, ErrInvalidDetail
@@ -176,7 +180,7 @@ func (s Service) Upsert(ctx context.Context, sd ServiceData) (ServiceData, error
 	}
 	sd.Key.ProjectSlug = prj.Slug
 
-	sd.Key.URN = sd.Key.CreateURN()
+	sd.Key.URN = CreateURN(sd.Key.ProjectSlug, sd.Key.Name)
 
 	sd.Key, err = s.repository.GetKeyByURN(ctx, sd.Key.URN)
 	if err != nil {

core/servicedata/servicedata.go

@@ -55,8 +55,8 @@ type Filter struct {
 	Project   string
 }
 
-func (key Key) CreateURN() string {
-	return fmt.Sprintf("%s:servicedata_key:%s", key.ProjectSlug, key.Name)
+func CreateURN(projectSlug, keyName string) string {
+	return fmt.Sprintf("%s:servicedata_key:%s", projectSlug, keyName)
 }
 
 func (key Key) ToKeyLogData() KeyLogData {

internal/api/v1beta1/relation.go

@@ -28,6 +28,7 @@ type RelationService interface {
 	DeleteV2(ctx context.Context, rel relation.RelationV2) error
 	GetRelationByFields(ctx context.Context, rel relation.RelationV2) (relation.RelationV2, error)
 	LookupResources(ctx context.Context, resourceType, permission, subjectType, subjectID string) ([]string, error)
+	CheckPermission(ctx context.Context, usr user.User, resourceNS namespace.Namespace, resourceIdxa string, action action.Action) (bool, error)
 }
 
 var grpcRelationNotFoundErr = status.Errorf(codes.NotFound, "relation doesn't exist")

internal/api/v1beta1/servicedata.go

@@ -33,6 +33,7 @@ type ServiceDataService interface {
 	CreateKey(ctx context.Context, key servicedata.Key) (servicedata.Key, error)
 	Upsert(ctx context.Context, serviceData servicedata.ServiceData) (servicedata.ServiceData, error)
 	Get(ctx context.Context, filter servicedata.Filter) ([]servicedata.ServiceData, error)
+	GetKeyByURN(ctx context.Context, urn string) (servicedata.Key, error)
 }
 
 func (h Handler) CreateServiceDataKey(ctx context.Context, request *shieldv1beta1.CreateServiceDataKeyRequest) (*shieldv1beta1.CreateServiceDataKeyResponse, error) {

internal/api/v1beta1/user.go

@@ -14,6 +14,8 @@ import (
 	"google.golang.org/grpc/status"
 	"google.golang.org/protobuf/types/known/timestamppb"
 
+	"github.com/goto/shield/core/action"
+	"github.com/goto/shield/core/namespace"
 	"github.com/goto/shield/core/project"
 	"github.com/goto/shield/core/relation"
 	"github.com/goto/shield/core/servicedata"
@@ -47,7 +49,7 @@ func (h Handler) ListUsers(ctx context.Context, request *shieldv1beta1.ListUsers
 	currentUser, err := h.userService.FetchCurrentUser(ctx)
 	if err != nil {
 		logger.Error(err.Error())
-		return nil, grpcInternalServerError
+		return nil, grpcUnauthenticated
 	}
 
 	servicedataKeyResourceIds, err := h.relationService.LookupResources(ctx, schema.ServiceDataKeyNamespace, schema.ViewPermission, schema.UserPrincipal, currentUser.ID)
@@ -94,14 +96,9 @@ func (h Handler) ListUsers(ctx context.Context, request *shieldv1beta1.ListUsers
 func (h Handler) CreateUser(ctx context.Context, request *shieldv1beta1.CreateUserRequest) (*shieldv1beta1.CreateUserResponse, error) {
 	logger := grpczap.Extract(ctx)
 
-	currentUserEmail, ok := user.GetEmailFromContext(ctx)
-	if !ok {
-		return nil, grpcUnauthenticated
-	}
-
-	currentUserEmail = strings.TrimSpace(currentUserEmail)
-	if currentUserEmail == "" {
-		logger.Error(ErrEmptyEmailID.Error())
+	currentUser, err := h.userService.FetchCurrentUser(ctx)
+	if err != nil {
+		logger.Error(err.Error())
 		return nil, grpcUnauthenticated
 	}
 
@@ -111,9 +108,8 @@ func (h Handler) CreateUser(ctx context.Context, request *shieldv1beta1.CreateUs
 
 	email := strings.TrimSpace(request.GetBody().GetEmail())
 	if email == "" {
-		email = currentUserEmail
+		return nil, grpcBadBodyError
 	}
-
 	if !isValidEmail(email) {
 		return nil, user.ErrInvalidEmail
 	}
@@ -124,6 +120,22 @@ func (h Handler) CreateUser(ctx context.Context, request *shieldv1beta1.CreateUs
 		return nil, grpcBadBodyError
 	}
 
+	for k, _ := range metaDataMap {
+		urn := servicedata.CreateURN(h.serviceDataConfig.DefaultServiceDataProject, k)
+		key, err := h.serviceDataService.GetKeyByURN(ctx, urn)
+		if err != nil {
+			return nil, err
+		}
+
+		permission, err := h.relationService.CheckPermission(ctx, currentUser, namespace.Namespace{ID: schema.ServiceDataKeyNamespace}, key.ResourceID, action.Action{ID: schema.EditPermission})
+		if err != nil {
+			return nil, err
+		}
+		if !permission {
+			return nil, status.Error(codes.PermissionDenied, fmt.Sprintf("you are not authorized to update %s key", k))
+		}
+	}
+
 	// TODO might need to check the valid email form
 	newUser, err := h.userService.Create(ctx, user.User{
 		Name:     request.GetBody().GetName(),
@@ -219,6 +231,12 @@ func (h Handler) CreateMetadataKey(ctx context.Context, request *shieldv1beta1.C
 func (h Handler) GetUser(ctx context.Context, request *shieldv1beta1.GetUserRequest) (*shieldv1beta1.GetUserResponse, error) {
 	logger := grpczap.Extract(ctx)
 
+	_, err := h.userService.FetchCurrentUser(ctx)
+	if err != nil {
+		logger.Error(err.Error())
+		return nil, grpcUnauthenticated
+	}
+
 	fetchedUser, err := h.userService.Get(ctx, request.GetId())
 	if err != nil {
 		logger.Error(err.Error())
@@ -306,6 +324,12 @@ func (h Handler) UpdateUser(ctx context.Context, request *shieldv1beta1.UpdateUs
 	logger := grpczap.Extract(ctx)
 	var updatedUser user.User
 
+	currentUser, err := h.userService.FetchCurrentUser(ctx)
+	if err != nil {
+		logger.Error(err.Error())
+		return nil, grpcUnauthenticated
+	}
+
 	if strings.TrimSpace(request.GetId()) == "" {
 		return nil, grpcUserNotFoundError
 	}
@@ -328,6 +352,22 @@ func (h Handler) UpdateUser(ctx context.Context, request *shieldv1beta1.UpdateUs
 		return nil, grpcBadBodyError
 	}
 
+	for k, _ := range metaDataMap {
+		urn := servicedata.CreateURN(h.serviceDataConfig.DefaultServiceDataProject, k)
+		key, err := h.serviceDataService.GetKeyByURN(ctx, urn)
+		if err != nil {
+			return nil, err
+		}
+
+		permission, err := h.relationService.CheckPermission(ctx, currentUser, namespace.Namespace{ID: schema.ServiceDataKeyNamespace}, key.ResourceID, action.Action{ID: schema.EditPermission})
+		if err != nil {
+			return nil, err
+		}
+		if !permission {
+			return nil, status.Error(codes.PermissionDenied, fmt.Sprintf("you are not authorized to update %s key", k))
+		}
+	}
+
 	id := request.GetId()
 	if uuid.IsValid(id) {
 		updatedUser, err = h.userService.UpdateByID(ctx, user.User{