Merge branch 'graphql-error-when-authorizing-with-no-permissions-defined' into 'master'

Sanity check for GraphQL authorized?

See merge request gitlab-org/gitlab-ce!29921

1 files changed, 6 insertions, 6 deletions

diff --git a/lib/gitlab/graphql/authorize/authorize_resource.rb b/lib/gitlab/graphql/authorize/authorize_resource.rb
index b367a97105c..ef5caaf5b0e 100644
--- a/lib/gitlab/graphql/authorize/authorize_resource.rb
+++ b/lib/gitlab/graphql/authorize/authorize_resource.rb
@@ -27,12 +27,6 @@ module Gitlab
           raise NotImplementedError, "Implement #find_object in #{self.class.name}"
         end
 
-        def authorized_find(*args)
-          object = find_object(*args)
-
-          object if authorized?(object)
-        end
-
         def authorized_find!(*args)
           object = find_object(*args)
           authorize!(object)
@@ -48,6 +42,12 @@ module Gitlab
         end
 
         def authorized?(object)
+          # Sanity check. We don't want to accidentally allow a developer to authorize
+          # without first adding permissions to authorize against
+          if self.class.required_permissions.empty?
+            raise Gitlab::Graphql::Errors::ArgumentError, "#{self.class.name} has no authorizations"
+          end
+
           self.class.required_permissions.all? do |ability|
             # The actions could be performed across multiple objects. In which
             # case the current user is common, and we could benefit from the