fix(auth): gate PMS-447 subscriber-Admin floor on invite absence #325

Merged

YousifShkara merged 1 commit from fix/PMS-447-preserve-invite-role into main

2026-06-21 06:13:53 +02:00

YousifShkara commented

2026-06-21 06:13:49 +02:00

Owner

PMS-447 added a single-tenancy admin floor that translates a subscriber (or unknown) Bunyip claim to Admin, on the premise that every signed-in Bunyip user owns their own one-person Mokosh tenant. That premise breaks for a user accepting a role-bearing invite into a SHARED org tenant: the inviting admin's chosen role (e.g. manager) is a deliberate least-privilege grant, and silently flooring it to Admin is an unintended elevation that contradicts the invite. The CI invited_user_lands_in_inviting_tenant_with_invite_role failure was exactly this: invite role manager was floored to admin.

Gate the floor on invite presence in place_bunyip_user: when the placement consumes a fresh invite the invite role stands as-is and only a platform-level Bunyip admin claim still overrides to SuperAdmin; non-invite placements keep the PMS-447 floor unchanged. The PMS-447 floor unit tests (which exercise the non-invite local-role path) stay green.

#PMS-447

PMS-447 added a single-tenancy admin floor that translates a `subscriber` (or unknown) Bunyip claim to `Admin`, on the premise that every signed-in Bunyip user owns their own one-person Mokosh tenant. That premise breaks for a user accepting a role-bearing invite into a SHARED org tenant: the inviting admin's chosen role (e.g. `manager`) is a deliberate least-privilege grant, and silently flooring it to `Admin` is an unintended elevation that contradicts the invite. The CI `invited_user_lands_in_inviting_tenant_with_invite_role` failure was exactly this: invite role `manager` was floored to `admin`. Gate the floor on invite presence in `place_bunyip_user`: when the placement consumes a fresh invite the invite role stands as-is and only a platform-level Bunyip `admin` claim still overrides to `SuperAdmin`; non-invite placements keep the PMS-447 floor unchanged. The PMS-447 floor unit tests (which exercise the non-invite local-role path) stay green. #PMS-447

YousifShkara self-assigned this

2026-06-21 06:13:49 +02:00

YousifShkara added 1 commit

2026-06-21 06:13:50 +02:00

fix(auth): gate PMS-447 subscriber-Admin floor on invite absence

Create release / Create release from merged PR (pull_request) Has been skipped

Details

E2E / Playwright against staging (pull_request) Successful in 37s

Details

Check / fmt + clippy + compile + unit/doc tests (pull_request) Successful in 1m29s

Details

Integration / integration tests (pull_request) Successful in 4m55s

Details

1e0efe342e

PMS-447 added a single-tenancy admin floor that translates a `subscriber` (or unknown) Bunyip claim to `Admin`, on the premise that every signed-in Bunyip user owns their own one-person Mokosh tenant. That premise breaks for a user accepting a role-bearing invite into a SHARED org tenant: the inviting admin's chosen role (e.g. `manager`) is a deliberate least-privilege grant, and silently flooring it to `Admin` is an unintended elevation that contradicts the invite. The CI `invited_user_lands_in_inviting_tenant_with_invite_role` failure was exactly this: invite role `manager` was floored to `admin`.

Gate the floor on invite presence in `place_bunyip_user`: when the placement consumes a fresh invite the invite role stands as-is and only a platform-level Bunyip `admin` claim still overrides to `SuperAdmin`; non-invite placements keep the PMS-447 floor unchanged. The PMS-447 floor unit tests (which exercise the non-invite local-role path) stay green.

#PMS-447

YousifShkara merged commit a31a5b7a32 into main

2026-06-21 06:13:53 +02:00

YousifShkara deleted branch fix/PMS-447-preserve-invite-role

2026-06-21 06:13:53 +02:00

YousifShkara referenced this pull request from a commit

2026-06-21 06:13:54 +02:00

Merge pull request 'fix(auth): gate PMS-447 subscriber-Admin floor on invite absence' (#325) from fix/PMS-447-preserve-invite-role into main