weichenandCursor
bcb122ac53
Reject empty environment/project, disable FAV consumers at register time, and keep historical classification/repair/replay as audited application use cases with no raw SQL entrypoint. Co-authored-by: Cursor <cursoragent@cursor.com>
41 lines
978 B
Go
41 lines
978 B
Go
package events
|
|
|
|
import (
|
|
"fmt"
|
|
"strings"
|
|
)
|
|
|
|
// ServicePrincipal is a per-consumer worker identity. It never inherits a user session.
|
|
type ServicePrincipal struct {
|
|
ID string
|
|
Environment string
|
|
Consumer string
|
|
Actions []string
|
|
}
|
|
|
|
func ValidatePrincipal(p ServicePrincipal) error {
|
|
if strings.TrimSpace(p.ID) == "" || strings.TrimSpace(p.Environment) == "" || strings.TrimSpace(p.Consumer) == "" {
|
|
return ErrAuthFailure
|
|
}
|
|
if p.Consumer == ConsumerFAV {
|
|
return ErrDisabledConsumer
|
|
}
|
|
if strings.EqualFold(p.ID, "wildcard") || strings.EqualFold(p.Consumer, "*") {
|
|
return ErrAuthFailure
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func AuthorizePrincipal(p ServicePrincipal, env string, projectID int64, action string) error {
|
|
if err := ValidatePrincipal(p); err != nil {
|
|
return err
|
|
}
|
|
if p.Environment != env || projectID <= 0 {
|
|
return ErrQuarantine
|
|
}
|
|
if !containsName(p.Actions, action) {
|
|
return fmt.Errorf("%w: action %s", ErrAuthFailure, action)
|
|
}
|
|
return nil
|
|
}
|