From 9da18e47153c412ae254b83428007fefbdf5ab0c Mon Sep 17 00:00:00 2001 From: MT Lewis Date: Fri, 18 Mar 2022 14:17:46 +0000 Subject: [PATCH] search: throw error for unexpected non-resource permissions when authorizing result-by-result We only reach this point in the code for types where the initial authorization returned CONDITIONAL -- ALLOWs return early immediately above, and types where the decision was DENY get filtered out entirely when querying. This means the call to isResourcePermission here is mostly about narrowing the types, since the only way for it to be false is if the PermissionPolicy returned a CONDITIONAL decision for a non-resource permission, which can't happen - it would throw an error during validation in the permission-backend. Signed-off-by: MT Lewis --- .../src/service/AuthorizedSearchEngine.ts | 23 +++++++++++++++---- 1 file changed, 18 insertions(+), 5 deletions(-) diff --git a/plugins/search-backend/src/service/AuthorizedSearchEngine.ts b/plugins/search-backend/src/service/AuthorizedSearchEngine.ts index cba5f0eca8..3e7dc6e147 100644 --- a/plugins/search-backend/src/service/AuthorizedSearchEngine.ts +++ b/plugins/search-backend/src/service/AuthorizedSearchEngine.ts @@ -198,14 +198,27 @@ export class AuthorizedSearchEngine implements SearchEngine { const permission = this.types[result.type]?.visibilityPermission; const resourceRef = result.document.authorization?.resourceRef; - if ( - !permission || - !isResourcePermission(permission) || - !resourceRef - ) { + if (!permission || !resourceRef) { return result; } + // We only reach this point in the code for types where the initial + // authorization returned CONDITIONAL -- ALLOWs return early + // immediately above, and types where the decision was DENY get + // filtered out entirely when querying. + // + // This means the call to isResourcePermission here is mostly about + // narrowing the type of permission - the only way to get here with a + // non-resource permission is if the PermissionPolicy returns a + // CONDITIONAL decision for a non-resource permission, which can't + // happen - it would throw an error during validation in the + // permission-backend. + if (!isResourcePermission(permission)) { + throw new Error( + `Unexpected conditional decision returned for non-resource permission "${permission.name}"`, + ); + } + return authorizer .load({ permission, resourceRef }) .then(decision =>