Repository navigation
fix(access): send the backend every permission except the identity provider's own - #61
Conversation
The backend projection only carried the admin:, tg:, wa:, groups:, web: and azure: prefixes, so granted esign:sign and esign:requests:manage never reached the backend and the dashboard hid the Signatures section.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
WalkthroughThe backend access projection now includes the ChangesBackend access projection
Priority: ➖ Normal Change: Bug fix Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Docstring Coverage |  |
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1… |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
| Title check | |
The title accurately describes the main change: the backend projection now receives permissions beyond the identity provider's own permissions, including the previously omitted esign: permissions. |
Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files. (1 skipped: 1 unsupported.)
✨ Finishing Touches
-
📝 Generate docstrings
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
…ovider's own Replaces the prefix allowlist with excluding the managed idp:* permissions, so a permission created in the dashboard reaches the backend without a code change.
lorenzocorallo
changed the title
1 participant
The backend projection only carried permissions with the
admin:,tg:,wa:,groups:,web:andazure:prefixes, so new permissions created in the dashboard (e.g.esign:sign,esign:requests:manage) never reached the backend until someone edited the code.The projection now carries every permission except the identity provider's own managed
idp:*permissions. Subjects with no projected permission are still left out of the snapshot.src/auth/access-projections.ts: dropprefixessrc/auth/access-snapshot.ts: filter withisManagedPermissionKeyidp:*is not