From 4b183633ab9a0dca7e6e1e39497e379483a2e452 Mon Sep 17 00:00:00 2001
From: Fabi <38692350+fgerschwiler@users.noreply.github.com>
Date: Wed, 2 Sep 2020 11:06:08 +0200
Subject: [PATCH] fix: check permissions for user grant (#687)

---
 .../eventsourcing/eventstore/user_grant.go    | 50 ++++++++++++-------
 1 file changed, 32 insertions(+), 18 deletions(-)

diff --git a/internal/management/repository/eventsourcing/eventstore/user_grant.go b/internal/management/repository/eventsourcing/eventstore/user_grant.go
index 09af7e177..818bcddbb 100644
--- a/internal/management/repository/eventsourcing/eventstore/user_grant.go
+++ b/internal/management/repository/eventsourcing/eventstore/user_grant.go
@@ -148,25 +148,15 @@ func handleSearchUserGrantPermissions(ctx context.Context, request *grant_model.
 	}
 
 	ids := authz.GetExplicitPermissionCtxIDs(permissions, projectReadPerm)
-	if _, q := request.GetSearchQuery(grant_model.UserGrantSearchKeyProjectID); q != nil {
-		containsID := false
-		for _, id := range ids {
-			if id == q.Value {
-				containsID = true
-				break
-			}
+	if _, query := request.GetSearchQuery(grant_model.UserGrantSearchKeyGrantID); query != nil {
+		result := checkContainsPermID(ids, query, request, sequence)
+		if result != nil {
+			return result
 		}
-		if !containsID {
-			result := &grant_model.UserGrantSearchResponse{
-				Offset:      request.Offset,
-				Limit:       request.Limit,
-				TotalResult: uint64(0),
-				Result:      []*grant_model.UserGrantView{},
-			}
-			if sequence != nil {
-				result.Sequence = sequence.CurrentSequence
-				result.Timestamp = sequence.CurrentTimestamp
-			}
+	}
+	if _, query := request.GetSearchQuery(grant_model.UserGrantSearchKeyProjectID); query != nil {
+		result := checkContainsPermID(ids, query, request, sequence)
+		if result != nil {
 			return result
 		}
 	}
@@ -174,6 +164,30 @@ func handleSearchUserGrantPermissions(ctx context.Context, request *grant_model.
 	return nil
 }
 
+func checkContainsPermID(ids []string, query *grant_model.UserGrantSearchQuery, request *grant_model.UserGrantSearchRequest, sequence *repository.CurrentSequence) *grant_model.UserGrantSearchResponse {
+	containsID := false
+	for _, id := range ids {
+		if id == query.Value {
+			containsID = true
+			break
+		}
+	}
+	if !containsID {
+		result := &grant_model.UserGrantSearchResponse{
+			Offset:      request.Offset,
+			Limit:       request.Limit,
+			TotalResult: uint64(0),
+			Result:      []*grant_model.UserGrantView{},
+		}
+		if sequence != nil {
+			result.Sequence = sequence.CurrentSequence
+			result.Timestamp = sequence.CurrentTimestamp
+		}
+		return result
+	}
+	return nil
+}
+
 func checkExplicitPermission(ctx context.Context, grantID, projectID string) error {
 	permissions := authz.GetRequestPermissionsFromCtx(ctx)
 	if authz.HasGlobalPermission(permissions) {