Protect record values on non-updatable fields

compose/internal/service/record.go

@@ -35,6 +35,7 @@ type (
 		CanUpdateRecord(context.Context, *types.Module) bool
 		CanDeleteRecord(context.Context, *types.Module) bool
 		CanReadRecordValue(context.Context, *types.ModuleField) bool
+		CanUpdateRecordValue(context.Context, *types.ModuleField) bool
 	}
 
 	RecordService interface {
@@ -274,6 +275,20 @@ func (svc record) sanitizeValues(module *types.Module, values types.RecordValueS
 		return
 	}
 
+	// Remove all values on un-updatable fields
+	values, err = values.Filter(func(v *types.RecordValue) (bool, error) {
+		var field = module.Fields.FindByName(v.Name)
+		if field == nil {
+			return false, errors.Errorf("no such field %q", v.Name)
+		}
+
+		return svc.ac.CanUpdateRecordValue(svc.ctx, field), nil
+	})
+
+	if err != nil {
+		return
+	}
+
 	var places = map[string]uint{}
 
 	return values.Walk(func(value *types.RecordValue) (err error) {

compose/internal/service/record_test.go

@@ -10,6 +10,7 @@ import (
 
 	"github.com/crusttech/crust/compose/types"
 	"github.com/crusttech/crust/internal/auth"
+	"github.com/crusttech/crust/internal/permissions"
 	"github.com/crusttech/crust/internal/test"
 )
 
@@ -25,6 +26,7 @@ func TestRecord(t *testing.T) {
 
 	moduleSvc := Module().With(ctx)
 	svc := Record().With(ctx)
+	svc.(*record).ac = AccessControl(&permissions.ServiceAllowAll{})
 
 	module1 := &types.Module{
 		NamespaceID: ns1.ID,
@@ -252,7 +254,9 @@ func TestRecord(t *testing.T) {
 
 func TestValueSanitizer(t *testing.T) {
 	var (
-		svc    = record{}
+		svc = record{
+			ac: AccessControl(&permissions.ServiceAllowAll{}),
+		}
 		module = &types.Module{
 			Fields: types.ModuleFieldSet{
 				&types.ModuleField{Name: "single1"},

internal/permissions/service_alt.go

@@ -17,6 +17,10 @@ func (ServiceAllowAll) Grant(ctx context.Context, wl Whitelist, rules ...*Rule)
 	return nil
 }
 
+func (ServiceAllowAll) FindRulesByRoleID(roleID uint64) (rr RuleSet) {
+	return
+}
+
 func (ServiceDenyAll) Can(ctx context.Context, res Resource, op Operation, ff ...CheckAccessFunc) bool {
 	return false
 }
@@ -24,3 +28,7 @@ func (ServiceDenyAll) Can(ctx context.Context, res Resource, op Operation, ff ..
 func (ServiceDenyAll) Grant(ctx context.Context, wl Whitelist, rules ...*Rule) (err error) {
 	return nil
 }
+
+func (ServiceDenyAll) FindRulesByRoleID(roleID uint64) (rr RuleSet) {
+	return
+}