refactor: authorize migrated legacy API operations - #273
Conversation
Includes tests and branch changelog.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3897352078
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| class APIData extends APIComponent { | ||
| public async find(options: any = {}, user?: ISecureUser) { | ||
| user=this.getUser(user); | ||
| options = { ...options, filter: user.qualifyInstances(options.filter || {}) }; |
There was a problem hiding this comment.
When a non-admin calls api.data.find with an items.* filter, qualifyInstances adds its authorization rules as a top-level $or, but Aggregate.find applies that $or before unwinding items while applying items.* predicates afterward. An instance containing both an Alice-visible item and a Bob-only item can therefore pass authorization through Alice's item and return Bob's item when the caller filters for it. Apply the authorization predicates to the same post-unwind item match, or prevent this wrapper from accepting item-level filters.
Useful? React with 👍 / 👎.
| } | ||
| public async startEvent(query, elementId, data = {}, user?: ISecureUser, options:IEngineOptions = {}): Promise<IExecution> { | ||
| user=this.getUser(user); | ||
| query = user.qualifyItems(query); |
There was a problem hiding this comment.
When a normal non-admin passes the string instance ID expected by Engine.startEvent, this line sends that primitive through SecureUser.qualifyItems, whose implementation assigns $or and optionally tenantId properties to its argument. In ESM strict mode this throws TypeError: Cannot create property '$or' on string ..., so authenticated non-admin callers can no longer start secondary events. Build and qualify an instance query, resolve its ID, and pass that ID to the engine instead.
Useful? React with 👍 / 👎.
1 participant
Summary
Provides authorized server-side wrappers for the useful operations being migrated from legacy
/api.BPMNAPI.engine.getBPMNAPI.data.findStack
Depends on
security/trusted-principal(#4).Validation