~edwargix/git.sr.ht

5be87e6796eecbe6df4a1615d5b4da3363aa99d9 — Drew DeVault 5 years ago 7832b4b
api: fix authentication for users other than me

Hah
3 files changed, 8 insertions(+), 7 deletions(-)

M api/auth/auth.go
M api/graph/schema.resolvers.go
M api/loaders/middleware.go
M api/auth/auth.go => api/auth/auth.go +2 -2
@@ 35,7 35,7 @@ const (
)

type User struct {
	Id               int
	ID               int
	Created          time.Time
	Updated          time.Time
	Username         string


@@ 130,7 130,7 @@ Expected 'Authentication: Bearer <token>'`, http.StatusForbidden)
				return
			}
			if err := rows.Scan(&expires, &scopes,
				&user.Id, &user.Username,
				&user.ID, &user.Username,
				&user.Created, &user.Updated,
				&user.Email,
				&user.UserType,

M api/graph/schema.resolvers.go => api/graph/schema.resolvers.go +1 -1
@@ 57,7 57,7 @@ func (r *queryResolver) Version(ctx context.Context) (*model.Version, error) {
func (r *queryResolver) Me(ctx context.Context) (*model.User, error) {
	user := auth.ForContext(ctx)
	return &model.User{
		ID:       user.Id,
		ID:       user.ID,
		Created:  user.Created,
		Updated:  user.Updated,
		Username: user.Username,

M api/loaders/middleware.go => api/loaders/middleware.go +5 -4
@@ 9,6 9,7 @@ import (

	"github.com/lib/pq"

	"git.sr.ht/~sircmpwn/git.sr.ht/api/auth"
	"git.sr.ht/~sircmpwn/git.sr.ht/api/graph/model"
)



@@ 73,11 74,11 @@ func fetchRepositoriesByID(ctx context.Context,
			FULL OUTER JOIN
				access ON repo.id = access.repo_id
			WHERE
				repo.id = ANY($1)
				AND (access.user_id = 1
					OR repo.owner_id = 1
				repo.id = ANY($2)
				AND (access.user_id = $1
					OR repo.owner_id = $1
					OR repo.visibility != 'private')
			`, pq.Array(ids)); err != nil {
			`, auth.ForContext(ctx).ID, pq.Array(ids)); err != nil {
			panic(err)
		}
		defer rows.Close()