fix: don't allow creating an auth with instance resources (#23674)

influxdata · Sep 13, 2022 · b87deb4 · b87deb4
1 parent 11019d2
commit b87deb4
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/authorization/middleware_auth.go b/authorization/middleware_auth.go
@@ -34,6 +34,11 @@ func (s *AuthedAuthorizationService) CreateAuthorization(ctx context.Context, a
 	if err := authorizer.VerifyPermissions(ctx, a.Permissions); err != nil {
 		return err
 	}
+	for _, v := range a.Permissions {
+		if v.Resource.Type == influxdb.InstanceResourceType {
+			return fmt.Errorf("authorizations cannot be created with the instance type, it is only used during setup")
+		}
+	}
 
 	return s.s.CreateAuthorization(ctx, a)
 }