17 lines
586 B
JavaScript
17 lines
586 B
JavaScript
|
/**
|
||
|
|
* AccessGrant authorization (L2 audit fix: AccessGrant join for AuthZ / IDOR prevention).
|
||
|
|
* Per AGENTS.md rule 7, resource-level authorization requires DB-level join
|
||
|
|
* before adapter PR (brief-2 / brief-3) can merge safely.
|
||
|
|
*/
|
||
|
|
|
||
|
|
export function buildAccessGrantJoin(query, userId, resourceId) {
|
||
|
|
// Join ensures user has an active grant before accessing resource.
|
||
|
|
return `
|
||
|
|
LEFT JOIN access_grants ag
|
||
|
|
ON ag.resource_id = ${resourceId}
|
||
|
|
AND ag.user_id = ${userId}
|
||
|
|
AND ag.status = 'granted'
|
||
|
|
WHERE (ag.id IS NOT NULL OR resource_owner = ${userId})
|
||
|
|
`;
|
||
|
|
}
|