Merge pull request #3878 from Infisical/fix-approval-policy-bypassing

Fix bypassing approval policies

backend/src/ee/services/access-approval-request/access-approval-request-service.ts

@@ -350,6 +350,12 @@ export const accessApprovalRequestServiceFactory = ({
     const canBypass = !policy.bypassers.length || policy.bypassers.some((bypasser) => bypasser.userId === actorId);
     const cannotBypassUnderSoftEnforcement = !(isSoftEnforcement && canBypass);
 
+    // Calculate break glass attempt before sequence checks
+    const isBreakGlassApprovalAttempt =
+      policy.enforcementLevel === EnforcementLevel.Soft &&
+      actorId === accessApprovalRequest.requestedByUserId &&
+      status === ApprovalStatus.APPROVED;
+
     const isApprover = policy.approvers.find((approver) => approver.userId === actorId);
     // If user is (not an approver OR cant self approve) AND can't bypass policy
     if ((!isApprover || (!policy.allowedSelfApprovals && isSelfApproval)) && cannotBypassUnderSoftEnforcement) {
@@ -409,15 +415,14 @@ export const accessApprovalRequestServiceFactory = ({
       const isApproverOfTheSequence = policy.approvers.find(
         (el) => el.sequence === presentSequence.step && el.userId === actorId
       );
-      if (!isApproverOfTheSequence) throw new BadRequestError({ message: "You are not reviewer in this step" });
+
+      // Only throw if actor is not the approver and not bypassing
+      if (!isApproverOfTheSequence && !isBreakGlassApprovalAttempt) {
+        throw new BadRequestError({ message: "You are not a reviewer in this step" });
+      }
     }
 
     const reviewStatus = await accessApprovalRequestReviewerDAL.transaction(async (tx) => {
-      const isBreakGlassApprovalAttempt =
-        policy.enforcementLevel === EnforcementLevel.Soft &&
-        actorId === accessApprovalRequest.requestedByUserId &&
-        status === ApprovalStatus.APPROVED;
-
       let reviewForThisActorProcessing: {
         id: string;
         requestId: string;

frontend/src/pages/secret-manager/SecretApprovalsPage/components/AccessApprovalRequest/components/ReviewAccessModal.tsx

@@ -439,10 +439,7 @@ export const ReviewAccessRequestModal = ({
             </div>
           ) : (
             <>
-              {isSoftEnforcement &&
+              {isSoftEnforcement && request.isRequestedByCurrentUser && canBypass && (
-                request.isRequestedByCurrentUser &&
-                !(request.isApprover && request.isSelfApproveAllowed) &&
-                canBypass && (
                 <div className="mt-2 flex flex-col space-y-2">
                   <Checkbox
                     onCheckedChange={(checked) => setBypassApproval(checked === true)}
@@ -451,8 +448,7 @@ export const ReviewAccessRequestModal = ({
                     className={twMerge("mr-2", bypassApproval ? "border-red/30 bg-red/10" : "")}
                   >
                     <span className="text-xs text-red">
-                        Approve without waiting for requirements to be met (bypass policy
+                      Approve without waiting for requirements to be met (bypass policy protection)
-                        protection)
                     </span>
                   </Checkbox>
                   {bypassApproval && (
@@ -460,7 +456,7 @@ export const ReviewAccessRequestModal = ({
                       label="Reason for bypass"
                       className="mt-2"
                       isRequired
-                        tooltipText="Enter a reason for bypassing the secret change policy"
+                      tooltipText="Enter a reason for bypassing the policy"
                     >
                       <Input
                         value={bypassReason}