Add Client resource type and scopes to authorization schema - #6
Conversation
…valuation implementation for ClientsPermissionsV2 Closes #35564 Signed-off-by: Martin Kanis <mkanis@redhat.com>
![augmentcode[bot]](https://avatars.githubusercontent.com/in/1027498?s=60&v=4){kind=small}
| RealmModel realm; | ||
| if (role.getContainer() instanceof ClientModel) { | ||
| realm = ((ClientModel)role.getContainer()).getRealm(); | ||
| if (Profile.isFeatureEnabled(Profile.Feature.ADMIN_FINE_GRAINED_AUTHZ)) { |
There was a problem hiding this comment.
The event listener is gated by ADMIN_FINE_GRAINED_AUTHZ, but elsewhere V2 logic (e.g., evaluator selection and schema enablement) uses ADMIN_FINE_GRAINED_AUTHZ_V2; consider using the same V2 flag here to avoid missing permission cleanup when V2 is enabled.
🤖 Was this useful? React with 👍 or 👎
|
|
||
| resourceStore.findByType(server, AdminPermissionsSchema.CLIENTS_RESOURCE_TYPE, resource -> { | ||
| if (hasGrantedPermission(resource, scope)) { | ||
| granted.add(resource.getName()); |
There was a problem hiding this comment.
This collects all resources of type "Clients" and adds resource.getName(), which will also include the type resource named "Clients"; consider excluding the type resource so the returned set contains only client IDs.
🤖 Was this useful? React with 👍 or 👎
| ResourceServer server = root.realmResourceServer(); | ||
| if (server == null) return false; | ||
|
|
||
| Resource resource = resourceStore.findByName(server, client.getId(), server.getId()); |
There was a problem hiding this comment.
The owner parameter in findByName uses server.getId(), but resources are created with owner set to resourceServer.getClientId; this mismatch can cause lookups to fail and skip per-client permissions.
🤖 Was this useful? React with 👍 or 👎
| ResourceServer server = root.realmResourceServer(); | ||
| if (server == null) return false; | ||
|
|
||
| Resource resource = resourceStore.findByName(server, AdminPermissionsSchema.CLIENTS_RESOURCE_TYPE, server.getId()); |
There was a problem hiding this comment.
Using findByName with an explicit owner (server.getId()) for the "Clients" resource may not match how the type resource is created; this can incorrectly return null and deny permissions.
🤖 Was this useful? React with 👍 or 👎
2 participants
No description provided.