awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-08 05:27:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

misc: allow users with create permission to add identities with no access

Browse Source
This commit is contained in:
Sheen Capadngan
2025-07-04 04:24:15 +08:00
parent 189b0dd5ee
commit cc564119e0
2 changed files with 39 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/services/identity-project/identity-project-service.ts
+19 -17
View File
@@ -93,23 +93,25 @@ export const identityProjectServiceFactory = ({
projectId projectId
); );
const permissionBoundary = validatePrivilegeChangeOperation( if (requestedRoleChange !== ProjectMembershipRole.NoAccess) {
membership.shouldUseNewPrivilegeSystem, const permissionBoundary = validatePrivilegeChangeOperation(
ProjectPermissionIdentityActions.GrantPrivileges, membership.shouldUseNewPrivilegeSystem,
ProjectPermissionSub.Identity, ProjectPermissionIdentityActions.GrantPrivileges,
permission, ProjectPermissionSub.Identity,
rolePermission permission,
); rolePermission
if (!permissionBoundary.isValid) );
throw new PermissionBoundaryError({ if (!permissionBoundary.isValid)
message: constructPermissionErrorMessage( throw new PermissionBoundaryError({
"Failed to assign to role", message: constructPermissionErrorMessage(
membership.shouldUseNewPrivilegeSystem, "Failed to assign to role",
ProjectPermissionIdentityActions.GrantPrivileges, membership.shouldUseNewPrivilegeSystem,
ProjectPermissionSub.Identity ProjectPermissionIdentityActions.GrantPrivileges,
), ProjectPermissionSub.Identity
details: { missingPermissions: permissionBoundary.missingPermissions } ),
}); details: { missingPermissions: permissionBoundary.missingPermissions }
});
}
} }
// validate custom roles input // validate custom roles input
backend/src/services/identity/identity-service.ts
+20 -17
View File
@@ -69,23 +69,25 @@ export const identityServiceFactory = ({
orgId orgId
); );
const isCustomRole = Boolean(customRole); const isCustomRole = Boolean(customRole);
const permissionBoundary = validatePrivilegeChangeOperation( if (role !== OrgMembershipRole.NoAccess) {
membership.shouldUseNewPrivilegeSystem, const permissionBoundary = validatePrivilegeChangeOperation(
OrgPermissionIdentityActions.GrantPrivileges, membership.shouldUseNewPrivilegeSystem,
OrgPermissionSubjects.Identity, OrgPermissionIdentityActions.GrantPrivileges,
permission, OrgPermissionSubjects.Identity,
rolePermission permission,
); rolePermission
if (!permissionBoundary.isValid) );
throw new PermissionBoundaryError({ if (!permissionBoundary.isValid)
message: constructPermissionErrorMessage( throw new PermissionBoundaryError({
"Failed to create identity", message: constructPermissionErrorMessage(
membership.shouldUseNewPrivilegeSystem, "Failed to create identity",
OrgPermissionIdentityActions.GrantPrivileges, membership.shouldUseNewPrivilegeSystem,
OrgPermissionSubjects.Identity OrgPermissionIdentityActions.GrantPrivileges,
), OrgPermissionSubjects.Identity
details: { missingPermissions: permissionBoundary.missingPermissions } ),
}); details: { missingPermissions: permissionBoundary.missingPermissions }
});
}
const plan = await licenseService.getPlan(orgId); const plan = await licenseService.getPlan(orgId);
@@ -187,6 +189,7 @@ export const identityServiceFactory = ({
), ),
details: { missingPermissions: appliedRolePermissionBoundary.missingPermissions } details: { missingPermissions: appliedRolePermissionBoundary.missingPermissions }
}); });
if (isCustomRole) customRole = customOrgRole; if (isCustomRole) customRole = customOrgRole;
} }