BED-6620 fix(AGT): get selector members not respecting certification #1971
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
WalkthroughAdds a conditional certification filter to selector-based asset group member retrieval: when Changes
Sequence Diagram(s)sequenceDiagram
autonumber
participant C as Client
participant A as API (GetAssetGroupMembersBySelector)
participant DB as Database
C->>A: Request selector-based members
A->>A: Load AssetGroupTag + selector config
alt RequireCertify = true
A->>A: Append SQL filter: certified > REVOKED
else RequireCertify = false
A->>A: Build base selector SQL
end
A->>DB: Execute query with parameters
DB-->>A: Rows (filtered by certification if applied)
A-->>C: Return members
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested labels
Suggested reviewers
Poem
Pre-merge checks and finishing touches❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
📜 Recent review detailsConfiguration used: CodeRabbit UI Review profile: CHILL Plan: Pro 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (5)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
cmd/api/src/api/v2/assetgrouptags.go (1)
771-774: LGTM! The certification filter correctly enforces RequireCertify constraints.The implementation properly filters out revoked and non-certified nodes when the asset group tag requires certification. The SQL concatenation pattern is consistent with the environment filter above (lines 766-769), and the use of
ValueOrZero()safely handles null values.Consider adding a brief inline comment to document the filter's purpose:
if assetGroupTag.RequireCertify.ValueOrZero() { + // Exclude revoked/non-certified nodes when certification is required filter.SQLString += " AND certified > ?" filter.Params = append(filter.Params, model.AssetGroupCertificationRevoked) }
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
cmd/api/src/api/v2/assetgrouptags.go(1 hunks)
🧰 Additional context used
🧠 Learnings (1)
📚 Learning: 2025-07-09T00:36:54.112Z
Learnt from: mistahj67
PR: SpecterOps/BloodHound#1648
File: cmd/api/src/api/v2/assetgrouptags.go:763-766
Timestamp: 2025-07-09T00:36:54.112Z
Learning: In cmd/api/src/api/v2/assetgrouptags.go, the SearchAssetGroupTags method intentionally fetches all asset group tags and selectors without database-level filtering because it needs to build a complete `kinds` array from all relevant tags for the graph query filter. This allows members to be searched across all tags of the requested type while still filtering the returned tags/selectors by name match.
Applied to files:
cmd/api/src/api/v2/assetgrouptags.go
🧬 Code graph analysis (1)
cmd/api/src/api/v2/assetgrouptags.go (1)
cmd/api/src/model/assetgrouptags.go (1)
AssetGroupCertificationRevoked(58-58)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (5)
- GitHub Check: Build BloodHound Container Image / Build and Package Container
- GitHub Check: run-tests
- GitHub Check: run-analysis
- GitHub Check: build-ui
- GitHub Check: run-tests
sirisjo
approved these changes
Oct 15, 2025
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Describe your changes in detail
Added filter for certified nodes only when asset group tag has certified required while getting selector members
Motivation and Context
Resolves BED-6620
Why is this change required? What problem does it solve?
How Has This Been Tested?
Have certify required disabled and then enabled and see the members list decrease with the latter
Please describe in detail how you tested your changes.
Include details of your testing environment, and the tests you ran to
see how your change affects other areas of the code, etc.
Screenshots (optional):
Types of changes
Checklist:
Summary by CodeRabbit