enhancement: only use allowed roles for the graph service

services/graph/pkg/validate/libregraph.go

@@ -90,9 +90,10 @@ func rolesAndActions(ctx context.Context, sl validator.StructLevel, roles, actio
 
 	switch roles, ok := ctx.Value(_contextRoleIDsValueKey).([]string); {
 	case ok:
-		definitions = unifiedrole.GetDefinitions(unifiedrole.RoleFilterIDs(roles...))
+		definitions = unifiedrole.GetRoles(unifiedrole.RoleFilterIDs(roles...))
 	default:
-		definitions = unifiedrole.GetDefinitions(unifiedrole.RoleFilterAll())
+		// it the ctx does not contain the allowed role IDs, we need to fall back to all roles
+		definitions = unifiedrole.GetRoles(unifiedrole.RoleFilterAll())
 	}
 
 	for _, definition := range definitions {
@@ -121,8 +122,8 @@ func rolesAndActions(ctx context.Context, sl validator.StructLevel, roles, actio
 		sl.ReportError(roles, "Roles", "Roles", "available_role", "")
 	}
 
-	for _, role := range actions {
-		if slices.Contains(availableActions, role) {
+	for _, action := range actions {
+		if slices.Contains(availableActions, action) {
 			continue
 		}
 

services/graph/pkg/validate/libregraph_test.go

@@ -16,10 +16,12 @@ import (
 type validatableFactory[T any] func() (T, bool)
 
 var _ = Describe("libregraph", func() {
+	var ctx context.Context
 	var driveItemInvite libregraph.DriveItemInvite
 	var driveRecipient libregraph.DriveRecipient
 
 	BeforeEach(func() {
+		ctx = context.Background()
 		driveRecipient = libregraph.DriveRecipient{
 			ObjectId:                conversions.ToPointer("1"),
 			LibreGraphRecipientType: conversions.ToPointer("user"),
@@ -27,18 +29,17 @@ var _ = Describe("libregraph", func() {
 
 		driveItemInvite = libregraph.DriveItemInvite{
 			Recipients:                   []libregraph.DriveRecipient{driveRecipient},
-			Roles:                        []string{role.UnifiedRoleEditorID},
-			LibreGraphPermissionsActions: []string{role.DriveItemVersionsUpdate},
+			Roles:                        []string{unifiedrole.UnifiedRoleEditorID},
+			LibreGraphPermissionsActions: []string{unifiedrole.DriveItemVersionsUpdate},
 			ExpirationDateTime:           libregraph.PtrTime(time.Now().Add(time.Hour)),
 		}
-
 	})
 
 	DescribeTable("DriveItemInvite",
 		func(factories ...validatableFactory[libregraph.DriveItemInvite]) {
 			for _, factory := range factories {
 				s, pass := factory()
-				switch err := validate.StructCtx(context.Background(), s); pass {
+				switch err := validate.StructCtx(ctx, s); pass {
 				case false:
 					Expect(err).To(HaveOccurred())
 				default:
@@ -61,8 +62,8 @@ var _ = Describe("libregraph", func() {
 		}),
 		Entry("fail: multiple role assignment", func() (libregraph.DriveItemInvite, bool) {
 			driveItemInvite.Roles = []string{
-				role.UnifiedRoleEditorID,
-				role.UnifiedRoleManagerID,
+				unifiedrole.UnifiedRoleEditorID,
+				unifiedrole.UnifiedRoleManagerID,
 			}
 			driveItemInvite.LibreGraphPermissionsActions = nil
 			return driveItemInvite, false
@@ -72,6 +73,14 @@ var _ = Describe("libregraph", func() {
 			driveItemInvite.LibreGraphPermissionsActions = nil
 			return driveItemInvite, false
 		}),
+		Entry("fail: disabled role", func() (libregraph.DriveItemInvite, bool) {
+			ctx = validate.ContextWithAllowedRoleIDs(ctx, []string{unifiedrole.UnifiedRoleEditorID})
+			driveItemInvite.Roles = []string{
+				unifiedrole.UnifiedRoleSecureViewerID,
+			}
+			driveItemInvite.LibreGraphPermissionsActions = nil
+			return driveItemInvite, false
+		}),
 		Entry("fail: unknown action", func() (libregraph.DriveItemInvite, bool) {
 			driveItemInvite.Roles = nil
 			driveItemInvite.LibreGraphPermissionsActions = []string{"foo"}
@@ -84,8 +93,8 @@ var _ = Describe("libregraph", func() {
 		}),
 		Entry("fail: different number of roles and actions", func() (libregraph.DriveItemInvite, bool) {
 			driveItemInvite.LibreGraphPermissionsActions = []string{
-				role.DriveItemVersionsUpdate,
-				role.DriveItemChildrenCreate,
+				unifiedrole.DriveItemVersionsUpdate,
+				unifiedrole.DriveItemChildrenCreate,
 			}
 			return driveItemInvite, false
 		}),