webiny / webiny-js

Open-source serverless enterprise CMS. Includes a headless CMS, page builder, form builder, and file manager. Easy to customize and expand. Deploys to AWS.
https://www.webiny.com
Other
7.29k stars 601 forks source link

fix(api-security): load permissions immediately after authentication #4093

Closed Pavel910 closed 4 months ago

Pavel910 commented 4 months ago

Changes

This PR ensures permissions are loaded right after the authentication, so that parallel code executions do not accidentally trigger multiple permission loads.

Authentication is executed in the BeforeHandler plugin, right after all the context plugins have been processed. This means that permissions will now also be loaded as part of the authentication process, and when any part of the code requests permissions, they will immediately be available.