thecore_auth_commons 3.6.0 → 3.6.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b77d8d01f744d28bf89e6901dc7061352926f7f70e386cdd77b90267d7665dfd
-  data.tar.gz: f9b35c8d3983fe50ac88d0ac1e73fa61e35f5b592fbe88bfbdaaf8aaab45dd91
+  metadata.gz: cbdfa5e8e3ee139099bf681626e66c17459f3c0df764de2d1795fcb5bba8a71e
+  data.tar.gz: 73c4937049f42505c872d0360bbb38889d038f1c135332081fe3237e2ea7c82b
 SHA512:
-  metadata.gz: ad45aad725755827751f9f78588cf7ccc1567f89a07eb1309b6d7c286e3e64e7975725c2b730435c08087026859689bea47bc37888e8c6aa4191fe0a99310e2e
-  data.tar.gz: 5853e1509cbd870f63e5e4a2d02c7ab7bd2fe61552760187dcf695306b2d04f27c3a46882f9e4e9cf8166727842736cd8ac7baedb8ff1f5bfeb7fa7f390dd7f0
+  metadata.gz: 59d97568329cf50d32c444eaef8059199bc6f4d192976ab5b04b9209414b405be8808d16cf7eb87617976effb084e76a374a336d84dba87bbbf0fdd269b23559
+  data.tar.gz: 22984f97a81b0a638cfa259ede0e525390d00889793976436744da448549c3d0cd4fd14ba8e7119ca67f1c36b3517b8c98c557a719c54e34aa0e99b580d22a6d

data/README.md

@@ -104,7 +104,7 @@ Multiple servers are supported, ordered by `priority` (ascending). Each server c
 
 On LDAP login or import, `memberOf` groups are read; matching group names become `Role` records assigned to the user. Groups named `Administrators`, `Domain Admins`, `Schema Admins`, `Enterprise Admins`, `admins`, or `administrators` also grant `user.admin = true`.
 
-Deleting a `LdapServer` record destroys all users whose `auth_source` is `"ldap #{id}"`.
+Deleting a `LdapServer` record keeps all users whose `auth_source` is `"ldap #{id}"` — same record, same roles — and turns them into local users (`auth_source = "local"`). To log in again they need a local password, set by hand.
 
 ### Background LDAP import
 

data/app/models/ldap_server.rb

@@ -10,8 +10,9 @@ class LdapServer < ApplicationRecord
   validates :base_dn, presence: true
 
   # Callbacks
-  # After the record is actually deleted from the DB, remove all associated users which have the same auth_source with value "ldap #{id}"
-  after_destroy :remove_users_with_auth_source
+  # Users imported from this server outlive it: they become local users, same record and roles,
+  # and need a local password set by hand to log in again.
+  after_destroy :turn_users_into_local_users
 
   def test_connection
     # Test the connection to the LDAP server
@@ -37,10 +38,10 @@ class LdapServer < ApplicationRecord
 
   private
 
-  # This method is called after the record is destroyed
-  def remove_users_with_auth_source
-    User.where(auth_source: "ldap #{id}").find_each do |user|
-      user.destroy
-    end
+  # Destroying the users here used to strip their roles even when the destroy was refused: a
+  # User's dependents are destroyed before any later before_destroy guard aborts, and the
+  # abort's rollback is swallowed inside this record's own transaction, so it never undid them.
+  def turn_users_into_local_users
+    User.where(auth_source: "ldap #{id}").update_all(auth_source: "local", updated_at: Time.current)
   end
 end

data/lib/thecore_auth_commons/version.rb

@@ -1,3 +1,3 @@
 module ThecoreAuthCommons
-  VERSION = "3.6.0".freeze
+  VERSION = "3.6.1".freeze
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: thecore_auth_commons
 version: !ruby/object:Gem::Version
-  version: 3.6.0
+  version: 3.6.1
 platform: ruby
 authors:
 - Gabriele Tassoni