Repository navigation
fix(permissions): keep staff:access out of full_session and the wildcard - #367
Merged
Merged
Conversation
![ferrfleet-interne[bot]](https://avatars.githubusercontent.com/in/5311663?s=60&v=4){kind=small}
There was a problem hiding this comment.
The change is correct. Merging the wildcard into the parsed set, instead of replacing it, keeps an explicit staff:access, and no other scope implies StaffAccess, so has() can't grant it by another route.
- Nit: two doc comments are now stale. Line 26 of the module doc still says sessions "get every scope implicitly". The doc on
from_strings_with_wildcard(~line 382) still calls"*"the "historical behaviour for staff-issued super-tokens", but"*"no longer grants staff access. - Nit: this changes behaviour for consumers. Any existing API token stored as
["*"]loses/admin/*access. Any service that relied onfull_session()for staff users now has toinsert(Scope::StaffAccess)after itsis_staffcheck. That is worth a line in the changelog or release notes so downstream crates catch it when they bump.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
full_session()and the*wildcard no longer grantStaffAccess; callers add it explicitly after theis_staffcheck. An explicitstaff:accessstring alongside*is still honored.OrgOwneris left infull_session()(issue marks it optional).Closes #347