sevenhill/QSfera
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fixed an idp guest role default assignment

Browse Source
This commit is contained in:
Roman Perekhod
2024-11-07 17:57:01 +01:00
parent d65f073c1c
commit 3a060331f7
5 changed files with 27 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/settings/pkg/service/v0/service.go
+2 -2
View File
@@ -380,12 +380,12 @@ func (g Service) AssignRoleToUser(ctx context.Context, req *settingssvc.AssignRo
switch {
case ownAccountUUID == req.AccountUuid:
// Allow users to assign themself to the user role
// Allow users to assign themself to the user or user light role
// deny any other attempt to change the user's own assignment
if r, err := g.manager.ListRoleAssignments(req.AccountUuid); err == nil && len(r) > 0 {
return merrors.Forbidden(g.id, "Changing own role assignment forbidden")
}
if req.RoleId != defaults.BundleUUIDRoleUser {
if req.RoleId != defaults.BundleUUIDRoleUser && req.RoleId != defaults.BundleUUIDRoleUserLight {
return merrors.Forbidden(g.id, "Changing own role assignment forbidden")
}
g.logger.Debug().Str("userid", ownAccountUUID).Msg("Self-assignment for default 'user' role permitted")
services/settings/pkg/service/v0/service_test.go
+9
View File
@@ -84,6 +84,15 @@ func TestEditOwnRoleAssignment(t *testing.T) {
err := svc.AssignRoleToUser(ctxWithUUID, &req, &res)
assert.Nil(t, err)
// Creating an initial self assignment is expected to succeed for UserLightRole when no assignment exists yet
req = v0.AssignRoleToUserRequest{
AccountUuid: "61445573-4dbe-4d56-88dc-88ab47aceba7",
RoleId: defaults.BundleUUIDRoleUserLight,
}
res = v0.AssignRoleToUserResponse{}
err = svc.AssignRoleToUser(ctxWithUUID, &req, &res)
assert.Nil(t, err)
// Creating an initial self assignment is expected to fail for non UserRole when no assignment exists yet
req = v0.AssignRoleToUserRequest{
AccountUuid: "61445573-4dbe-4d56-88dc-88ab47aceba7",