From e7b1189620baaf03c2d23f6e164d07c7c7d87d57 Mon Sep 17 00:00:00 2001
From: Jordan Dominion <Cyberboss@users.noreply.github.com>
Date: Fri, 3 Jan 2025 18:43:02 -0500
Subject: [PATCH] Fix UserEnabled role being OR'd with action authorization
 roles FUUUUUCCCKK!!!!

Fixes #2064
---
 src/Tgstation.Server.Host/Core/Application.cs     |  5 ++++-
 .../Security/TgsAuthorizeAttribute.cs             | 15 ++++++++++++---
 .../Security/TgsGraphQLAuthorizeAttribute.cs      |  8 ++++++--
 3 files changed, 22 insertions(+), 6 deletions(-)

diff --git a/src/Tgstation.Server.Host/Core/Application.cs b/src/Tgstation.Server.Host/Core/Application.cs
index 2517f8502f..f0cf647c79 100644
--- a/src/Tgstation.Server.Host/Core/Application.cs
+++ b/src/Tgstation.Server.Host/Core/Application.cs
@@ -298,7 +298,10 @@ namespace Tgstation.Server.Host.Core
 			services
 				.AddScoped<GraphQL.Subscriptions.ITopicEventReceiver, ShutdownAwareTopicEventReceiver>()
 				.AddGraphQLServer()
-				.AddAuthorization()
+				.AddAuthorization(
+					options => options.AddPolicy(
+						TgsAuthorizeAttribute.PolicyName,
+						builder => builder.RequireRole(TgsAuthorizeAttribute.UserEnabledRole)))
 				.ModifyOptions(options =>
 				{
 					options.EnsureAllNodesCanBeResolved = true;
diff --git a/src/Tgstation.Server.Host/Security/TgsAuthorizeAttribute.cs b/src/Tgstation.Server.Host/Security/TgsAuthorizeAttribute.cs
index d03c2f9e6d..4f68a6e894 100644
--- a/src/Tgstation.Server.Host/Security/TgsAuthorizeAttribute.cs
+++ b/src/Tgstation.Server.Host/Security/TgsAuthorizeAttribute.cs
@@ -15,10 +15,15 @@ namespace Tgstation.Server.Host.Security
 	[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, AllowMultiple = true, Inherited = true)]
 	sealed class TgsAuthorizeAttribute : AuthorizeAttribute
 	{
+		/// <summary>
+		/// Policy used to apply global requirement of <see cref="UserEnabledRole"/>.
+		/// </summary>
+		public const string PolicyName = "Policy.UserEnabled";
+
 		/// <summary>
 		/// Role used to indicate access to the server is allowed.
 		/// </summary>
-		public const string UserEnabledRole = "Core.UserEnabled";
+		public const string UserEnabledRole = "Role.UserEnabled";
 
 		/// <summary>
 		/// Gets the <see cref="Api.Rights.RightsType"/> associated with the <see cref="TgsAuthorizeAttribute"/> if any.
@@ -130,8 +135,12 @@ namespace Tgstation.Server.Host.Security
 		private TgsAuthorizeAttribute(IEnumerable<string> roles)
 		{
 			var listRoles = roles.ToList();
-			listRoles.Add(UserEnabledRole);
-			Roles = String.Join(",", listRoles);
+			if (listRoles.Count != 0)
+			{
+				Roles = String.Join(",", listRoles);
+			}
+
+			Policy = PolicyName;
 		}
 	}
 }
diff --git a/src/Tgstation.Server.Host/Security/TgsGraphQLAuthorizeAttribute.cs b/src/Tgstation.Server.Host/Security/TgsGraphQLAuthorizeAttribute.cs
index e03e7e6081..2bd0bfac52 100644
--- a/src/Tgstation.Server.Host/Security/TgsGraphQLAuthorizeAttribute.cs
+++ b/src/Tgstation.Server.Host/Security/TgsGraphQLAuthorizeAttribute.cs
@@ -125,8 +125,12 @@ namespace Tgstation.Server.Host.Security
 		private TgsGraphQLAuthorizeAttribute(IEnumerable<string> roleNames)
 		{
 			var listRoles = roleNames.ToList();
-			listRoles.Add(TgsAuthorizeAttribute.UserEnabledRole);
-			Roles = [.. listRoles];
+			if (listRoles.Count != 0)
+			{
+				Roles = [.. listRoles];
+			}
+
+			Policy = TgsAuthorizeAttribute.PolicyName;
 			Apply = ApplyPolicy.Validation;
 		}
 	}