Post-validate every lookup against the resolved entity
- Dominant language
- Python
- Stars
- 670
- Forks
- 183
- Avg merge
- 17h 7m
- Merged PRs (30d)
- 358
Description
Every lookup gets a post-validator requiring READ on the entity it resolves - not only the user and session lookups (LookupUserAction answers account existence and uuid for any email; LookupSessionAction lets a caller probe another user's session names) but the catalog lookups too. Catalog entities rely on the authenticated-user presets granting their READ, so this lands after the BA-7571 preset fixture; until then the graph would deny regular users.
JIRA Issue: BA-7586
Contributor guide
Research direction
Start by locating the post-validator mechanism and the LookupUserAction and LookupSessionAction entry points, then trace the catalog lookups and the authenticated-user presets. Use the BA-7571 preset fixture as the dependency context. Done means every lookup validates READ access on its resolved entity without denying regular users once those presets are present.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- api, authorization, backend
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100