From 83c7828e38123056eb70a7f18c767acc2a83f557 Mon Sep 17 00:00:00 2001
From: Cyberboss <Cyberboss@users.noreply.github.com>
Date: Mon, 28 Dec 2020 10:59:11 -0500
Subject: [PATCH] Don't set InstancePermissionSet for instances not on the
 swarm node

---
 .../Security/AuthenticationContextFactory.cs    | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/src/Tgstation.Server.Host/Security/AuthenticationContextFactory.cs b/src/Tgstation.Server.Host/Security/AuthenticationContextFactory.cs
index bef18b9b7c..be393e8db9 100644
--- a/src/Tgstation.Server.Host/Security/AuthenticationContextFactory.cs
+++ b/src/Tgstation.Server.Host/Security/AuthenticationContextFactory.cs
@@ -1,9 +1,11 @@
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
 using System;
 using System.Linq;
 using System.Threading;
 using System.Threading.Tasks;
+using Tgstation.Server.Host.Configuration;
 using Tgstation.Server.Host.Database;
 using Tgstation.Server.Host.Models;
 
@@ -30,19 +32,27 @@ namespace Tgstation.Server.Host.Security
 		/// </summary>
 		readonly ILogger<AuthenticationContextFactory> logger;
 
+		/// <summary>
+		/// The <see cref="SwarmConfiguration"/> for the <see cref="AuthenticationContextFactory"/>.
+		/// </summary>
+		readonly SwarmConfiguration swarmConfiguration;
+
 		/// <summary>
 		/// Construct an <see cref="AuthenticationContextFactory"/>
 		/// </summary>
 		/// <param name="databaseContext">The value of <see cref="databaseContext"/></param>
 		/// <param name="identityCache">The value of <see cref="identityCache"/></param>
+		/// <param name="swarmConfigurationOptions">The <see cref="IOptions{TOptions}"/> containing the value of <see cref="swarmConfiguration"/>.</param>
 		/// <param name="logger">The value of <see cref="logger"/>.</param>
 		public AuthenticationContextFactory(
 			IDatabaseContext databaseContext,
 			IIdentityCache identityCache,
+			IOptions<SwarmConfiguration> swarmConfigurationOptions,
 			ILogger<AuthenticationContextFactory> logger)
 		{
 			this.databaseContext = databaseContext ?? throw new ArgumentNullException(nameof(databaseContext));
 			this.identityCache = identityCache ?? throw new ArgumentNullException(nameof(identityCache));
+			swarmConfiguration = swarmConfigurationOptions?.Value ?? throw new ArgumentNullException(nameof(swarmConfigurationOptions));
 			this.logger = logger ?? throw new ArgumentNullException(nameof(logger));
 		}
 
@@ -96,7 +106,7 @@ namespace Tgstation.Server.Host.Security
 				{
 					instancePermissionSet = await databaseContext.InstancePermissionSets
 						.AsQueryable()
-						.Where(x => x.PermissionSetId == userPermissionSet.Id && x.InstanceId == instanceId)
+						.Where(x => x.PermissionSetId == userPermissionSet.Id && x.InstanceId == instanceId && x.Instance.SwarmIdentifer == swarmConfiguration.Identifier)
 						.Include(x => x.Instance)
 						.FirstOrDefaultAsync(cancellationToken)
 						.ConfigureAwait(false);
@@ -105,7 +115,10 @@ namespace Tgstation.Server.Host.Security
 						logger.LogDebug("User {0} does not have permissions on instance {1}!", userId, instanceId.Value);
 				}
 
-				CurrentAuthenticationContext = new AuthenticationContext(systemIdentity, user, instancePermissionSet);
+				CurrentAuthenticationContext = new AuthenticationContext(
+					systemIdentity,
+					user,
+					instancePermissionSet);
 			}
 			catch
 			{