Merge branch 'secure-repository' into 'main'

Authorize reading/writing Sparkles using SpiceDB

See merge request gitlab-org/software-supply-chain-security/authorization/sparkled!20

1 files changed, 11 insertions, 6 deletions

diff --git a/app/init.go b/app/init.go
index ea67e48..8e5e0e5 100644
--- a/app/init.go
+++ b/app/init.go
@@ -19,6 +19,7 @@ import (
 	"gitlab.com/gitlab-org/software-supply-chain-security/authorization/sparkled/app/domain"
 	"gitlab.com/gitlab-org/software-supply-chain-security/authorization/sparkled/app/jobs"
 	"gitlab.com/gitlab-org/software-supply-chain-security/authorization/sparkled/pkg/authz"
+	"gitlab.com/gitlab-org/software-supply-chain-security/authorization/sparkled/pkg/pls"
 	"gitlab.com/gitlab-org/software-supply-chain-security/authorization/sparkled/pkg/web"
 )
 
@@ -47,7 +48,13 @@ func init() {
 		))
 	})
 	ioc.RegisterSingleton[domain.Repository[*domain.Sparkle]](c, func() domain.Repository[*domain.Sparkle] {
-		return db.NewRepository[*domain.Sparkle](ioc.MustResolve[*event.TypedAggregator[*domain.Sparkle]](c))
+		aggregator := ioc.MustResolve[*event.TypedAggregator[*domain.Sparkle]](c)
+		client := ioc.MustResolve[*authzed.Client](c)
+
+		return db.NewRepository[*domain.Sparkle](
+			db.WithAuthorization[*domain.Sparkle](client),
+			db.WithPublishing(aggregator),
+		)
 	})
 	ioc.RegisterSingleton[*http.ServeMux](c, func() *http.ServeMux {
 		return http.NewServeMux()
@@ -83,9 +90,7 @@ func init() {
 
 	logger := ioc.MustResolve[*zerolog.Logger](c)
 	ctx := logger.WithContext(context.Background())
-	client := ioc.MustResolve[*authzed.Client](c)
-
-	ioc.
-		MustResolve[*event.TypedAggregator[*domain.Sparkle]](c).
-		SubscribeTo("after.create", jobs.NewCreateSparkle(ctx, client).Run)
+	if err := jobs.Boot(ctx, c); err != nil {
+		pls.LogErrorNow(ctx, err)
+	}
 }