Open TejasRGitHub opened 9 months ago
Hi @TejasRGitHub I found why you opened this issue. In data.all v2 we established different functional layers in the backend: api, sservices, db... In the modules this separation of concerns is strictly enforced, for the core components however some refactoring tasks are still pending. Coming back to your issue, the permissions checker in apis such as createOrganization
. The permissions check should happen in the services of organization, instead it happens in the db layer. It is not that it is not implemented, but that the code is in the wrong placed according to the standards that we set ourselves.
Let me know if this is the issue that you were describing, otherwise we will close this issue in favor of #741 that already accounts for the core refactoring
Hi @dlpzx , So the issue I am describing is that the query parameters in a graphQL query are not validated. Please correct me if I am wrong, the permissions checker as described by from the screenshot ( @has_tenant_permission ) will only check if the user has permission to create organization but it won't check if the group / team that will be used for that organization is valid or not.
Describe the bug
For GraphQL APIs like CreateOrganization , there is not validation before executing the graphQL query.
With a ID token, a simple curl command can be used to create organization with a team which doesn't even exists.
Creating this Github issue to list such APIs where validation is needed before executing APIs
How to Reproduce
curl 'https://.execute-api.us-east-1.amazonaws.com/prod/graphql/api' \
-H 'authority: .execute-api.us-east-1.amazonaws.com' \
-H 'accept: /' \
-H 'accept-language: en-US,en;q=0.9' \
-H 'access-control-allow-origin: ' \
-H 'accesscontrolallowheaders: ' \
-H 'accesscontrolalloworigin: *' \
-H 'accesskeyid: none' \
-H 'authorization: ID_TOKEN' \
-H 'content-type: application/json' \
-H 'origin: DOMAIN_URL' \
-H 'referer: DOMAIN_URL/' \
-H 'sec-ch-ua: "Google Chrome";v="119", "Chromium";v="119", "Not?A_Brand";v="24"' \
-H 'sec-ch-ua-mobile: ?0' \
-H 'sec-ch-ua-platform: "macOS"' \
-H 'sec-fetch-dest: empty' \
-H 'sec-fetch-mode: cors' \
-H 'sec-fetch-site: cross-site' \
-H 'secretkey: none' \
-H 'user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36' \
--data-raw '{"operationName":"CreateOrg","variables":{"input":{"label":"Temp-Orgs","description":"","SamlGroupName":"","tags":["Somtage"]}},"query":"mutation CreateOrg($input: NewOrganizationInput) {\n createOrganization(input: $input) {\n organizationUri\n label\n created\n __typename\n }\n}\n"}' \
--compressed