From 5e07f9501b8b23217a0c4f9a3d18283303cb7d84 Mon Sep 17 00:00:00 2001
From: Benedikt Kulmann <benedikt@kulmann.biz>
Date: Mon, 24 Aug 2020 17:07:30 +0200
Subject: [PATCH] Check permissions on full bundles

---
 pkg/service/v0/service.go | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/pkg/service/v0/service.go b/pkg/service/v0/service.go
index b8a494402..dd1f27f00 100644
--- a/pkg/service/v0/service.go
+++ b/pkg/service/v0/service.go
@@ -91,6 +91,22 @@ func (g Service) ListBundles(c context.Context, req *proto.ListBundlesRequest, r
 	// filter settings in bundles that are allowed according to roles
 	var filteredBundles []*proto.Bundle
 	for _, bundle := range bundles {
+		// check if full bundle is whitelisted
+		bundleResource := &proto.Resource{
+			Type: proto.Resource_TYPE_BUNDLE,
+			Id:   bundle.Id,
+		}
+		if g.hasPermission(
+			roleIDs,
+			bundleResource,
+			[]proto.Permission_Operation{proto.Permission_OPERATION_READ, proto.Permission_OPERATION_READWRITE},
+			proto.Permission_CONSTRAINT_OWN,
+		) {
+			filteredBundles = append(filteredBundles, bundle)
+			continue
+		}
+
+		// filter settings based on permissions
 		var filteredSettings []*proto.Setting
 		for _, setting := range bundle.Settings {
 			settingResource := &proto.Resource{