Fix GetProfileById auth perms (#1937)

This is a rehash of #1936 but without the noise.
mindersec · Dec 14, 2023 · a03bc3e · a03bc3e
1 parent 851ff7c
commit a03bc3e
Show file tree

Hide file tree

Showing 2 changed files with 88 additions and 83 deletions.
diff --git a/pkg/api/protobuf/go/minder/v1/minder.pb.go b/pkg/api/protobuf/go/minder/v1/minder.pb.go
diff --git a/proto/minder/v1/minder.proto b/proto/minder/v1/minder.proto
@@ -402,7 +402,12 @@ service ProfileService {
     rpc GetProfileById (GetProfileByIdRequest) returns (GetProfileByIdResponse) {
         option (google.api.http) = {
             get: "/api/v1/profile/{id}"
-            };    
+        };    
+
+        option (rpc_options) = {
+            auth_scope: OBJECT_OWNER_PROJECT
+            owner_only: false
+        };
     }
 
     rpc GetProfileStatusByName (GetProfileStatusByNameRequest) returns (GetProfileStatusByNameResponse) {