From 1cbe7c8848c3bd0505b5b5d134817e6c7d45c2c3 Mon Sep 17 00:00:00 2001 From: Gabriel MABILLE Date: Wed, 8 Oct 2025 21:41:44 +0200 Subject: [PATCH] `AuthZ`: log incomplete folder tree (#112151) --- pkg/services/authz/rbac/service.go | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/pkg/services/authz/rbac/service.go b/pkg/services/authz/rbac/service.go index 45d2c97c11d..3aa77178b1e 100644 --- a/pkg/services/authz/rbac/service.go +++ b/pkg/services/authz/rbac/service.go @@ -678,6 +678,11 @@ func (s *Service) checkInheritedPermissions(ctx context.Context, scopeMap map[st ctxLogger.Error("could not build folder and dashboard tree", "error", err) return false, err } + if !s.isFolderInTree(tree, req.ParentFolder) { + // Not erroring here as the permission might exist but the folder wasn't synchronized yet + // Once in mode 5 we can deny access here + ctxLogger.Error("parent folder not found in folder tree", "folder", req.ParentFolder) + } } if scopeMap["folders:uid:"+req.ParentFolder] { @@ -724,6 +729,9 @@ func (s *Service) buildFolderTree(ctx context.Context, ns types.NamespaceInfo) ( span.SetAttributes(attribute.Int("num_folders", len(folders))) tree := newFolderTree(folders) + if len(tree.Nodes) != len(folders) { + s.logger.FromContext(ctx).Warn("mismatched folder count when building tree", "namespace", ns.Value, "expected", len(folders), "got", len(tree.Nodes)) + } s.folderCache.Set(ctx, folderCacheKey(ns.Value), tree) return tree, nil