Function authorizeQuery

edgraph/access.go:957–1047

authorizeQuery authorizes the query using the aclCachePtr. It will silently drop all unauthorized predicates from query. At this stage, namespace is not attached in the predicates.

(ctx context.Context, parsedReq *dql.Result, graphql bool)

// unauthorized predicates from query.
// At this stage, namespace is not attached in the predicates.
func authorizeQuery(ctx context.Context, parsedReq *dql.Result, graphql bool) error {
	if worker.Config.AclSecretKey == nil {
		// the user has not turned on the acl feature
		return nil
	}

	var userId string
	var groupIds []string
	var namespace uint64
	predsAndvars := parsePredsFromQuery(parsedReq.Query)
	preds := predsAndvars.preds
	varsToPredMap := predsAndvars.vars

	// Need this to efficiently identify blocked variables from the
	// list of blocked predicates
	predToVarsMap := make(map[string]string)
	for k, v := range varsToPredMap {
		predToVarsMap[v] = k
	}

	doAuthorizeQuery := func() (map[string]struct{}, []string, error) {
		userData, err := extractUserAndGroups(ctx)
		if err != nil {
			return nil, nil, status.Error(codes.Unauthenticated, err.Error())
		}

		userId = userData.userId
		groupIds = userData.groupIds
		namespace = userData.namespace

		if x.IsSuperAdmin(groupIds) {
			if shouldAllowAcls(userData.namespace) {
				// Members of guardian groups are allowed to query anything.
				return nil, nil, nil
			}
			return blockedPreds(preds), nil, nil
		}

		result := authorizePreds(ctx, userData, preds, acl.Read)
		return result.blocked, result.allowed, nil
	}

	blockedPreds, allowedPreds, err := doAuthorizeQuery()
	if err != nil {
		return err
	}

	if span := otrace.FromContext(ctx); span != nil {
		span.Annotatef(nil, (&accessEntry{
			userId:    userId,
			groups:    groupIds,
			preds:     preds,
			operation: acl.Read,
			allowed:   err == nil,
		}).String())
	}

	if len(blockedPreds) != 0 {