https://krtffl.dev/tags/authorization/ Recent content in authorization on krtffl.dev Hugo -- gohugo.io en © [krtffl](https://krtffl.dev) Mon, 23 Dec 2024 00:00:00 +0000 https://krtffl.dev/posts/owner-scoped-rbac-go/ Mon, 23 Dec 2024 00:00:00 +0000 https://krtffl.dev/posts/owner-scoped-rbac-go/ <p>two users hit <code>GET /dojos</code>. same route, same handler, same line of sql underneath. the admin gets back every dojo in the database. the dojo owner gets back exactly one — theirs. nobody wrote a second endpoint, nobody passed a flag. the query just quietly narrowed itself on the way down, and the owner never learns the other rows exist.</p> <p>the first time that worked in mojodojo i felt clever. &ldquo;you can only see your own&rdquo; is the whole ballgame in a multi-tenant app, and here it was falling out of the architecture for free. then i went looking for <em>where</em> it happened, and the answer was: two different files, in two different layers, that don&rsquo;t fully agree with each other. one of them has a hole you could drive a truck through.</p>