feat: add bulk update p ermission check

Signed-off-by: tygao <tygao@amazon.com>
raintygao · Jul 24, 2023 · 6255127 · 6255127
1 parent 6af0dbe
commit 6255127
Showing 1 changed file with 10 additions and 0 deletions.
diff --git a/src/core/server/workspaces/saved_objects/workspace_saved_objects_client_wrapper.ts b/src/core/server/workspaces/saved_objects/workspace_saved_objects_client_wrapper.ts
@@ -190,6 +190,16 @@ export class WorkspaceSavedObjectsClientWrapper {
       objects: Array<SavedObjectsBulkUpdateObject<T>>,
       options: SavedObjectsBulkUpdateOptions = {}
     ) => {
+      const objectToBulkUpdate = await wrapperOptions.client.bulkGet<T>(objects, options);
+      for (const object of objectToBulkUpdate.saved_objects) {
+        if (isWorkspacesLikeAttributes(object.attributes)) {
+          await this.validateMultiWorkspacesPermissions(
+            object.attributes.workspaces,
+            wrapperOptions.request,
+            WorkspacePermissionMode.Admin
+          );
+        }
+      }
       return await wrapperOptions.client.bulkUpdate(objects, options);
     };