Auditors authentication landing on wrong org (#2463)

* use can_view_org instead so roles like auditors can view

* add auditor login test

* bump to 1.26.4 to fix vulnerability

* go mod tidy

* try to use distinct email

Author: adelowo

cli/go.mod

@@ -1,6 +1,6 @@
 module github.com/theopenlane/core/cli
 
-go 1.26.3
+go 1.26.4
 
 require (
 	github.com/99designs/gqlgen v0.17.90

common/go.mod

@@ -1,6 +1,6 @@
 module github.com/theopenlane/core/common
 
-go 1.26.3
+go 1.26.4
 
 require (
 	entgo.io/ent v0.14.6

common/go.sum

@@ -1,4 +1,5 @@
 ariga.io/atlas v1.2.1 h1:xLIs6vThJ2J9Bl8gXFZhXbNyMf4yFuBeJ7AYlZ+Tn6M=
+ariga.io/atlas v1.2.1/go.mod h1:vg7qWSatkNqs04Y4Lheg7vR4bGX0wy51Wz4FIMFVr3U=
 entgo.io/contrib v0.7.0 h1:4Ghx8O0rqSMmca3FIJ6QyZbQAoLvdzWqLMl1MbHFEEw=
 entgo.io/contrib v0.7.0/go.mod h1:zbPSUrbn+6dfyv8S9HWEvn1MyGpO95ik2lUNgaqWTt4=
 entgo.io/ent v0.14.6 h1:/f2696BpwuWAEEG6PVGWflg6+Inrpq4pRWuNlWz/Skk=

docker/all-in-one/Dockerfile.all-in-one

@@ -1,4 +1,4 @@
-FROM golang:1.26.3 as builder
+FROM golang:1.26.4 as builder
 
 WORKDIR /go/src/app
 COPY . .

go.mod

@@ -1,6 +1,6 @@
 module github.com/theopenlane/core
 
-go 1.26.3
+go 1.26.4
 
 tool (
 	github.com/dave/jennifer

go.work

@@ -1,4 +1,4 @@
-go 1.26.3
+go 1.26.4
 
 use (
 	// core is the main module containing the API and business logic, nothing in pkg or internal should be imported by other modules

internal/ent/hooks/usersettings.go

@@ -84,10 +84,11 @@ func allowDefaultOrgUpdate(ctx context.Context, m *generated.UserSettingMutation
 		SubjectID:   owner.ID,
 		SubjectType: auth.UserSubjectType,
 		ObjectID:    orgID,
+		Relation:    "can_view_org",
 		Context:     utils.NewOrganizationContextKey(usCaller.SubjectEmail),
 	}
 
-	allow, err := m.Authz.CheckOrgReadAccess(ctx, req)
+	allow, err := m.Authz.CheckOrgAccess(ctx, req)
 	if err != nil {
 		return false
 	}

internal/httpserve/authmanager/authmanager.go

@@ -262,15 +262,16 @@ func (a *Client) authCheck(ctx context.Context, user *generated.User, orgID stri
 		orgID = caller.OrganizationID
 	}
 
-	// ensure user is already a member of the destination organization
+	// ensure user can access the destination organization
 	req := fgax.AccessCheck{
 		SubjectID:   caller.SubjectID,
 		SubjectType: auth.UserSubjectType,
 		ObjectID:    orgID,
+		Relation:    "can_view_org",
 		Context:     utils.NewOrganizationContextKey(caller.SubjectEmail),
 	}
 
-	allow, err := a.db.Authz.CheckOrgReadAccess(ctx, req)
+	allow, err := a.db.Authz.CheckOrgAccess(ctx, req)
 	if err != nil {
 		logx.FromContext(ctx).Error().Err(err).Str("user_id", caller.SubjectID).Str("org_id", orgID).Msg("unable to check org read access")
 

internal/httpserve/handlers/login_test.go

@@ -110,6 +110,14 @@ func (suite *HandlerTestSuite) TestLoginHandler() {
 		confirmedUser: true,
 		tfaEnabled:    tfaTrue,
 	})
+
+	auditorUser := suite.userBuilderWithInput(ctx, &userInput{
+		email:         "auditor+" + strings.ToLower(ulids.New().String()) + "@examples.com",
+		password:      validPassword,
+		confirmedUser: true,
+		tfaEnabled:    tfaTrue,
+	})
+
 	// setup allow context with the client in the context which is required for hooks that run
 	allowCtx := privacy.DecisionContext(validConfirmedUserRestrictedOrg.UserCtx, privacy.Allow)
 	allowCtx = ent.NewContext(allowCtx, suite.db)
@@ -121,6 +129,10 @@ func (suite *HandlerTestSuite) TestLoginHandler() {
 	ctxTargetOrg = privacy.DecisionContext(ctxTargetOrg, privacy.Allow)
 	testUserCtx := ent.NewContext(ctxTargetOrg, suite.db)
 
+	auditorOrgCtx := auth.NewTestContextWithOrgID(validConfirmedUserRestrictedOrg.ID, org.ID)
+	auditorOrgCtx = privacy.DecisionContext(auditorOrgCtx, privacy.Allow)
+	auditorOrgCtx = ent.NewContext(auditorOrgCtx, suite.db)
+
 	suite.db.OrgMembership.Create().SetInput(generated.CreateOrgMembershipInput{
 		OrganizationID: createdssoOrg.ID,
 		UserID:         ssoMember.UserInfo.ID,
@@ -129,6 +141,14 @@ func (suite *HandlerTestSuite) TestLoginHandler() {
 
 	suite.db.UserSetting.UpdateOneID(ssoMember.UserInfo.Edges.Setting.ID).SetDefaultOrgID(createdssoOrg.ID).ExecX(allowCtx)
 
+	suite.db.OrgMembership.Create().SetInput(generated.CreateOrgMembershipInput{
+		OrganizationID: org.ID,
+		UserID:         auditorUser.UserInfo.ID,
+		Role:           &enums.RoleAuditor,
+	}).ExecX(auditorOrgCtx)
+
+	suite.db.UserSetting.UpdateOneID(auditorUser.UserInfo.Edges.Setting.ID).SetDefaultOrgID(org.ID).ExecX(allowCtx)
+
 	// update the user settings to have the default org set that is the domain restricted org
 	suite.db.UserSetting.UpdateOneID(validConfirmedUserRestrictedOrg.UserInfo.Edges.Setting.ID).
 		SetDefaultOrgID(org.ID).ExecX(allowCtx)
@@ -176,6 +196,18 @@ func (suite *HandlerTestSuite) TestLoginHandler() {
 				models.CatalogTrustCenterModule.String(),
 			},
 		},
+		{
+			name:           "happy path, auditor default org",
+			username:       auditorUser.UserInfo.Email,
+			password:       validPassword,
+			expectedStatus: http.StatusOK,
+			expectedOrgID:  org.ID,
+			expectedModules: []interface{}{
+				models.CatalogBaseModule.String(),
+				models.CatalogComplianceModule.String(),
+				models.CatalogTrustCenterModule.String(),
+			},
+		},
 		{
 			name:            "domain restricted org, email not allowed, switch to personal org",
 			username:        invalidConfirmedUserRestrictedOrg.UserInfo.Email,