feat: 테넌트 그룹 기반 권한 상속 고도화 및 개발자 포털 보안 강화 #239

2026-02-11 12:41:03 +09:00
parent dc0d1a8e63
commit afaac1781c
11 changed files with 282 additions and 34 deletions
--- a/backend/internal/handler/dev_handler.go
+++ b/backend/internal/handler/dev_handler.go
@@ -22,15 +22,17 @@ type DevHandler struct {
 	SecretRepo  domain.ClientSecretRepository
 	KratosAdmin *service.KratosAdminService
 	ConsentRepo repository.ClientConsentRepository
+	RPService   service.RelyingPartyService
 }

-func NewDevHandler(redis domain.RedisRepository, secretRepo domain.ClientSecretRepository, consentRepo repository.ClientConsentRepository) *DevHandler {
+func NewDevHandler(redis domain.RedisRepository, secretRepo domain.ClientSecretRepository, consentRepo repository.ClientConsentRepository, rpService service.RelyingPartyService) *DevHandler {
 	return &DevHandler{
 		Hydra:       service.NewHydraAdminService(),
 		Redis:       redis,
 		SecretRepo:  secretRepo,
 		KratosAdmin: service.NewKratosAdminService(),
 		ConsentRepo: consentRepo,
+		RPService:   rpService,
 	}
 }

@@ -95,38 +97,58 @@ type clientUpsertRequest struct {
 }

 func (h *DevHandler) ListClients(c *fiber.Ctx) error {
-	limit := c.QueryInt("limit", 50)
-	offset := c.QueryInt("offset", 0)
-	if limit <= 0 {
-		limit = 50
-	}
-	if offset < 0 {
-		offset = 0
+	profile, ok := c.Locals("user_profile").(*domain.UserProfileResponse)
+	if !ok {
+		return c.Status(fiber.StatusUnauthorized).JSON(fiber.Map{"error": "unauthorized: user profile not found"})
 	}

-	clients, err := h.Hydra.ListClients(c.Context(), limit, offset)
+	// Super Admin sees all (best effort via Hydra list for now, or we can use RPService if it's improved)
+	if profile.Role == domain.RoleSuperAdmin {
+		limit := c.QueryInt("limit", 50)
+		offset := c.QueryInt("offset", 0)
+		clients, err := h.Hydra.ListClients(c.Context(), limit, offset)
+		if err != nil {
+			return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+		}
+		items := make([]clientSummary, 0, len(clients))
+		for _, client := range clients {
+			items = append(items, h.mapClientSummary(client))
+		}
+		return c.JSON(clientListResponse{Items: items, Limit: limit, Offset: offset})
+	}
+
+	// For others, only show manageable tenants' clients
+	var tenantIDs []string
+	for _, t := range profile.ManageableTenants {
+		tenantIDs = append(tenantIDs, t.ID)
+	}
+
+	if len(tenantIDs) == 0 && profile.TenantID != nil {
+		tenantIDs = append(tenantIDs, *profile.TenantID)
+	}
+
+	if len(tenantIDs) == 0 {
+		return c.JSON(clientListResponse{Items: []clientSummary{}, Limit: 50, Offset: 0})
+	}
+
+	rps, err := h.RPService.ListByTenantIDs(c.Context(), tenantIDs)
 	if err != nil {
-		if errors.Is(err, service.ErrHydraNotFound) {
-			return c.Status(fiber.StatusNotFound).JSON(fiber.Map{"error": "clients not found"})
-		}
-		errMsg := err.Error()
-		if strings.Contains(errMsg, "connection refused") || strings.Contains(errMsg, "dial tcp") {
-			return c.Status(fiber.StatusServiceUnavailable).JSON(fiber.Map{
-				"error": "Hydra service is unavailable. Please check if Ory Hydra is running.",
-			})
-		}
-		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": errMsg})
+		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
 	}

-	items := make([]clientSummary, 0, len(clients))
-	for _, client := range clients {
-		items = append(items, h.mapClientSummary(client))
+	items := make([]clientSummary, 0, len(rps))
+	for _, rp := range rps {
+		// We need HydraClient details for the summary
+		client, err := h.Hydra.GetClient(c.Context(), rp.ClientID)
+		if err == nil {
+			items = append(items, h.mapClientSummary(*client))
+		}
 	}

 	return c.JSON(clientListResponse{
 		Items:  items,
-		Limit:  limit,
-		Offset: offset,
+		Limit:  len(items),
+		Offset: 0,
 	})
 }

@@ -197,11 +219,46 @@ func (h *DevHandler) UpdateClientStatus(c *fiber.Ctx) error {
 }

 func (h *DevHandler) CreateClient(c *fiber.Ctx) error {
+	profile, ok := c.Locals("user_profile").(*domain.UserProfileResponse)
+	if !ok {
+		return c.Status(fiber.StatusUnauthorized).JSON(fiber.Map{"error": "unauthorized"})
+	}
+
 	var req clientUpsertRequest
 	if err := c.BodyParser(&req); err != nil {
 		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "invalid request body"})
 	}

+	// Determine Tenant ID
+	targetTenantID := c.Get("X-Tenant-ID")
+	if targetTenantID == "" && profile.TenantID != nil {
+		targetTenantID = *profile.TenantID
+	}
+
+	if targetTenantID == "" {
+		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "X-Tenant-ID header is required"})
+	}
+
+	// Validate Permission
+	isAllowed := false
+	if profile.Role == domain.RoleSuperAdmin {
+		isAllowed = true
+	} else {
+		for _, t := range profile.ManageableTenants {
+			if t.ID == targetTenantID {
+				isAllowed = true
+				break
+			}
+		}
+		if !isAllowed && profile.TenantID != nil && *profile.TenantID == targetTenantID {
+			isAllowed = true
+		}
+	}
+
+	if !isAllowed {
+		return c.Status(fiber.StatusForbidden).JSON(fiber.Map{"error": "you do not have permission to create clients for this tenant"})
+	}
+
 	clientID := strings.TrimSpace(valueOr(req.ID, ""))
 	if clientID == "" {
 		clientID = uuid.NewString()
@@ -257,11 +314,18 @@ func (h *DevHandler) CreateClient(c *fiber.Ctx) error {
 		Metadata:                metadata,
 	}

-	created, err := h.Hydra.CreateClient(c.Context(), clientReq)
+	// Use RPService to ensure Keto relations are created
+	rp, err := h.RPService.Create(c.Context(), targetTenantID, clientReq)
 	if err != nil {
 		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
 	}

+	// Fetch back the Hydra client to get the secret (RPService.Create returns domain.RelyingParty which has limited fields)
+	created, err := h.Hydra.GetClient(c.Context(), rp.ClientID)
+	if err != nil {
+		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": "client created but failed to retrieve details"})
+	}
+
 	// Store secret in metadata for later retrieval
 	if created.ClientSecret != "" {
 		// 1. Store in PostgreSQL (Source of Truth)
@@ -403,11 +467,24 @@ func (h *DevHandler) DeleteClient(c *fiber.Ctx) error {
 }

 func (h *DevHandler) ListConsents(c *fiber.Ctx) error {
+	profile, ok := c.Locals("user_profile").(*domain.UserProfileResponse)
+	if !ok {
+		return c.Status(fiber.StatusUnauthorized).JSON(fiber.Map{"error": "unauthorized"})
+	}
+
 	clientID := strings.TrimSpace(c.Query("client_id"))
 	if clientID == "" {
 		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "client_id is required"})
 	}

+	// Permission Check
+	if profile.Role != domain.RoleSuperAdmin {
+		allowed, err := h.RPService.CheckPermission(c.Context(), profile.ID, clientID, "view")
+		if err != nil || !allowed {
+			return c.Status(fiber.StatusForbidden).JSON(fiber.Map{"error": "forbidden: you do not have permission to view consents for this client"})
+		}
+	}
+
 	subject := strings.TrimSpace(c.Query("subject"))
 	limit := c.QueryInt("limit", 50)
 	offset := c.QueryInt("offset", 0)
@@ -484,12 +561,28 @@ func (h *DevHandler) ListConsents(c *fiber.Ctx) error {
 }

 func (h *DevHandler) RevokeConsents(c *fiber.Ctx) error {
+	profile, ok := c.Locals("user_profile").(*domain.UserProfileResponse)
+	if !ok {
+		return c.Status(fiber.StatusUnauthorized).JSON(fiber.Map{"error": "unauthorized"})
+	}
+
 	subject := strings.TrimSpace(c.Query("subject"))
 	if subject == "" {
 		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "subject is required"})
 	}
 	clientID := strings.TrimSpace(c.Query("client_id"))

+	// Permission Check (if clientID is provided)
+	if clientID != "" && profile.Role != domain.RoleSuperAdmin {
+		allowed, err := h.RPService.CheckPermission(c.Context(), profile.ID, clientID, "manage")
+		if err != nil || !allowed {
+			return c.Status(fiber.StatusForbidden).JSON(fiber.Map{"error": "forbidden: you do not have permission to revoke consents for this client"})
+		}
+	} else if clientID == "" && profile.Role != domain.RoleSuperAdmin {
+		// If clientID is not provided, we might need a more global check or just disallow it for non-superadmins
+		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "client_id is required for non-superadmins"})
+	}
+
 	// If subject is not a UUID, try to resolve it as an identifier (email/username)
 	if _, err := uuid.Parse(subject); err != nil {
 		resolved, err := h.KratosAdmin.FindIdentityIDByIdentifier(c.Context(), subject)