From 83763b49ce12fadd10c81cbc6d72ab70459d2858 Mon Sep 17 00:00:00 2001 From: Denis Arh Date: Wed, 6 Oct 2021 16:14:28 +0200 Subject: [PATCH] Do not allow membership changes on contextual roles --- system/service/role.go | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/system/service/role.go b/system/service/role.go index a421e7658..825052126 100644 --- a/system/service/role.go +++ b/system/service/role.go @@ -127,6 +127,10 @@ func (svc role) IsClosed(r *types.Role) bool { return len(r.Handle) > 0 && svc.closed[r.Handle] } +func (svc role) IsContextual(r *types.Role) bool { + return r.Meta != nil && r.Meta.Context != nil && len(r.Meta.Context.Expr) > 0 +} + func (svc role) Find(ctx context.Context, filter types.RoleFilter) (rr types.RoleSet, f types.RoleFilter, err error) { var ( raProps = &roleActionProps{filter: &filter} @@ -611,7 +615,7 @@ func (svc role) MemberList(ctx context.Context, roleID uint64) (mm types.RoleMem return err } - if svc.IsClosed(r) { + if svc.IsClosed(r) || svc.IsContextual(r) { return RoleErrNotAllowedToManageMembers() } @@ -649,7 +653,7 @@ func (svc role) MemberAdd(ctx context.Context, roleID, memberID uint64) (err err raProps.setRole(r) - if svc.IsClosed(r) { + if svc.IsClosed(r) || svc.IsContextual(r) { return RoleErrNotAllowedToManageMembers() } @@ -698,7 +702,7 @@ func (svc role) MemberRemove(ctx context.Context, roleID, memberID uint64) (err return } - if svc.IsClosed(r) { + if svc.IsClosed(r) || svc.IsContextual(r) { return RoleErrNotAllowedToManageMembers() }