@7365admin1/core 3.62.1-staging.280 → 3.62.1-staging.281
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.changeset/role-v2-platform-grant.md +14 -0
- package/dist/index.js +4 -0
- package/dist/index.js.map +1 -1
- package/dist/index.mjs +4 -0
- package/dist/index.mjs.map +1 -1
- package/package.json +1 -1
- package/test/role-scope.test.mjs +26 -0
|
@@ -0,0 +1,14 @@
|
|
|
1
|
+
---
|
|
2
|
+
"@7365admin1/core": patch
|
|
3
|
+
---
|
|
4
|
+
|
|
5
|
+
Stop `/api/roles/v2` minting a role that holds the console's own resources.
|
|
6
|
+
|
|
7
|
+
`role.controller createRole` has carried `requireNoPlatformGrant` for a while;
|
|
8
|
+
`role-v2.controller createRole` did not. It is a separate controller behind a
|
|
9
|
+
separate route and accepts any permission string, so the hole was reachable by
|
|
10
|
+
adding `/v2` to the URL.
|
|
11
|
+
|
|
12
|
+
Measured on production before adding: no site-scoped role holds a platform-only
|
|
13
|
+
string, and this mount requires a `site`, so the check refuses nothing that
|
|
14
|
+
exists today. It only ever refuses a NEW grant regardless.
|
package/dist/index.js
CHANGED
|
@@ -88940,6 +88940,10 @@ function useRoleControllerV2() {
|
|
|
88940
88940
|
if (value.org) {
|
|
88941
88941
|
await requireOrgReach(req, value.org);
|
|
88942
88942
|
}
|
|
88943
|
+
requireNoPlatformGrant(
|
|
88944
|
+
{ type: value.type, org: value.org, permissions: [] },
|
|
88945
|
+
value.permissions
|
|
88946
|
+
);
|
|
88943
88947
|
requireWithinModules(
|
|
88944
88948
|
await moduleCeiling(value.org, value.site),
|
|
88945
88949
|
value.permissions
|