Skip to content

feat: refactor authorization logic to load policies per group and improve error handling #1673

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Artuomka merged 1 commit into from
Mar 17, 2026
Merged

feat: refactor authorization logic to load policies per group and improve error handling #1673

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
53 changes: 24 additions & 29 deletions backend/src/entities/cedar-authorization/cedar-authorization.service.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -186,47 +186,42 @@ export class CedarAuthorizationService implements ICedarAuthorizationService, On
const userGroups = await this.globalDbContext.groupRepository.findAllUserGroupsInConnection(connectionId, userId);
if (userGroups.length === 0) return false;

const userGroupIds = userGroups.map((g) => g.id);
const policies = await this.loadPoliciesForUser(connectionId, userId, userGroupIds);
if (!policies) return false;
const groupPolicies = await this.loadPoliciesPerGroup(connectionId, userGroups);
if (groupPolicies.length === 0) return false;

const entities = buildCedarEntities(userId, userGroups, connectionId, tableName, dashboardId);

Comment on lines +189 to 193
const call = {
principal: { type: CEDAR_USER_TYPE, id: userId },
action: { type: CEDAR_ACTION_TYPE, id: action },
resource: { type: resourceType as string, id: resourceId },
context: {},
policies: { staticPolicies: policies },
entities: entities,
schema: this.schema,
};

const result = cedarWasm.isAuthorized(call as Parameters<typeof cedarWasm.isAuthorized>[0]);
if (result.type === 'success') {
return result.response.decision === 'allow';
for (const policy of groupPolicies) {
const call = {
principal: { type: CEDAR_USER_TYPE, id: userId },
action: { type: CEDAR_ACTION_TYPE, id: action },
resource: { type: resourceType as string, id: resourceId },
context: {},
policies: { staticPolicies: policy },
entities: entities,
schema: this.schema,
};

const result = cedarWasm.isAuthorized(call as Parameters<typeof cedarWasm.isAuthorized>[0]);
if (result.type === 'success') {
if (result.response.decision === 'allow') {
return true;
}
Comment on lines +205 to +209
} else {
this.logger.warn(`Cedar authorization error for group policy: ${JSON.stringify(result.errors)}`);
}
Comment on lines +210 to +212
}

this.logger.warn(`Cedar authorization error: ${JSON.stringify(result.errors)}`);
return false;
}

private async loadPoliciesForUser(connectionId: string, userId: string, userGroupIds: string[]): Promise<string | null> {
const cached = Cacher.getCedarPolicyCache(connectionId, userId);
if (cached !== null) return cached;

private async loadPoliciesPerGroup(connectionId: string, userGroups: Array<GroupEntity>): Promise<string[]> {
const groups = await this.globalDbContext.groupRepository.findAllGroupsInConnection(connectionId);
const userGroupIdSet = new Set(userGroupIds);
const policyTexts = groups
const userGroupIdSet = new Set(userGroups.map((g) => g.id));
return groups
.filter((g) => userGroupIdSet.has(g.id))
Comment on lines +218 to 222
.map((g) => g.cedarPolicy)
.filter(Boolean);

if (policyTexts.length === 0) return null;

const combined = policyTexts.join('\n\n');
Cacher.setCedarPolicyCache(connectionId, userId, combined);
return combined;
}

private async assertUserNotSuspended(userId: string): Promise<void> {
Expand Down
Loading