eliaskohout/ax
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: remove global readability of namespace nodes
Build and Publish Arch Package / build-arch (amd64, x86_64) (push) Successful in 50s
Details
Build and Publish Arch Package / build-arch (arm64, aarch64) (push) Successful in 43s
Details
Build and Publish Docker Image / build-apk (amd64, x86_64) (push) Successful in 44s
Details
Build and Publish Docker Image / build-apk (arm64, aarch64) (push) Successful in 55s
Details
Build and Publish Docker Image / build-and-push-docker (push) Successful in 10m46s
Details

Browse Source
This commit is contained in:
Elias Kohout
2026-06-12 16:09:51 +02:00
parent c1f196640b
commit 61c8867742
1 changed files with 6 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/service/node_service_impl.go
+3 -4
View File
@@ -185,16 +185,15 @@ func (s *nodeServiceImpl) getPermContext() (*permContext, error) {
} }
} }
// User and namespace nodes are globally readable (they represent identities, // User nodes are globally readable (they represent identities,
// and anyone can reference or assign to them). // and anyone can reference or assign to them).
for _, nodeType := range []string{"user", "namespace"} { // Namespace nodes are NOT globally readable; access must be explicitly granted.
nodes, _ := s.store.FindNodes([]*models.Rel{{Type: models.RelType("_type::" + nodeType), Target: ""}}) nodes, _ := s.store.FindNodes([]*models.Rel{{Type: "_type::user", Target: ""}})
for _, n := range nodes { for _, n := range nodes {
if pc.levels[n.ID] < permRead { if pc.levels[n.ID] < permRead {
pc.levels[n.ID] = permRead pc.levels[n.ID] = permRead
} }
} }
}
return pc, nil return pc, nil
} }