Method requireVaultMember

internal/server/server.go:655–692

requireVaultMember checks that the session has member+ access to the vault. For scoped sessions: requires sess.VaultRole is "member" or "admin". For instance-level sessions: checks the unified vault_grants table.

(w http.ResponseWriter, r *http.Request, vaultID string)

// For scoped sessions: requires sess.VaultRole is "member" or "admin".
// For instance-level sessions: checks the unified vault_grants table.
func (s *Server) requireVaultMember(w http.ResponseWriter, r *http.Request, vaultID string) (*Actor, error) {
	sess := sessionFromContext(r.Context())
	if sess == nil {
		jsonError(w, http.StatusForbidden, "Authentication required")
		return nil, fmt.Errorf("no session")
	}

	// Scoped session: check vault_role from session.
	if sess.VaultID != "" {
		if sess.VaultID != vaultID {
			jsonError(w, http.StatusForbidden, "Session not authorized for this vault")
			return nil, fmt.Errorf("vault mismatch")
		}
		if !roleSatisfies(sess.VaultRole, "member") {
			jsonError(w, http.StatusForbidden, "Member role required")
			return nil, fmt.Errorf("insufficient role: %s", sess.VaultRole)
		}
		return nil, nil
	}

	// Instance-level session: check vault grant and role.
	actor, err := s.actorFromSession(r.Context(), sess)
	if err != nil {
		jsonError(w, http.StatusForbidden, "Invalid session")
		return nil, err
	}

	role, err := s.store.GetVaultRole(r.Context(), actor.ID, vaultID)
	if err != nil {
		jsonError(w, http.StatusForbidden, "No access to this vault")
		return nil, fmt.Errorf("no vault grant")
	}
	if !roleSatisfies(role, "member") {
		jsonError(w, http.StatusForbidden, "Member role required")
		return nil, fmt.Errorf("insufficient role: %s", role)
	}
	return actor, nil
}

// assertBuiltinCredentialStore writes 409 and returns false when the vault
// is external-backed. Fails closed (500) on transient lookup errors.