psa-systems/mokosh-server
Watch
9
0
Fork
You've already forked mokosh-server
 1
Code Issues Pull requests Projects Releases 10 Packages Wiki Activity Actions

fix(auth): elevate allowlisted bunyip admins to super_admin on login #139

Closed
David wants to merge 0 commits from david/fix/pms-162-bunyip-jit-admin-allowlist into main AGit
pull from: david/fix/pms-162-bunyip-jit-admin-allowlist
merge into: psa-systems:main
Conversation 0 Commits - Files changed 529 +64 -1
David commented 2026-06-09 16:52:47 +02:00
Owner
Copy link

Bunyip-issued at+jwt access tokens carry no role claim, so the JIT path in ensure_user_from_bunyip provisioned every subject as UserRole::default() (Technician) and never re-roled the row afterward. That 403s the admin-gated PSA routes (per-tenant module enable, SLA policy writes) for accounts that ARE listed in OAUTH_SUPER_ADMIN_EMAILS, which is what broke the e2e core-module specs on PR #136 (run #622): auth succeeded but the test account could not enable modules or create an SLA policy.

Consult the existing super_admin_emails allowlist (already used fail-closed by the Google login path in provision_user_from_google) from the bunyip path: a never-before-seen allowlisted subject provisions straight as super_admin, and an existing allowlisted row is elevated on each login since upsert_user_from_oidc's ON CONFLICT never touches the role. Promotion is idempotent and a no-op for any non-allowlisted user; DB errors degrade to the existing role rather than dropping the session.

#PMS-162

Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com

Bunyip-issued at+jwt access tokens carry no role claim, so the JIT path in `ensure_user_from_bunyip` provisioned every subject as `UserRole::default()` (Technician) and never re-roled the row afterward. That 403s the admin-gated PSA routes (per-tenant module enable, SLA policy writes) for accounts that ARE listed in `OAUTH_SUPER_ADMIN_EMAILS`, which is what broke the e2e core-module specs on PR #136 (run #622): auth succeeded but the test account could not enable modules or create an SLA policy. Consult the existing `super_admin_emails` allowlist (already used fail-closed by the Google login path in `provision_user_from_google`) from the bunyip path: a never-before-seen allowlisted subject provisions straight as super_admin, and an existing allowlisted row is elevated on each login since `upsert_user_from_oidc`'s ON CONFLICT never touches the role. Promotion is idempotent and a no-op for any non-allowlisted user; DB errors degrade to the existing role rather than dropping the session. #PMS-162 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
fix(auth): elevate allowlisted bunyip admins to super_admin on login
Some checks failed
E2E (staging) / Playwright against staging (pull_request) Failing after 28s
Details
Check / fmt + clippy + compile + tests (pull_request) Successful in 1m53s
Details
Create release / Create release from merged PR (pull_request) Has been skipped
Details
dc2eec888e 
Bunyip-issued at+jwt access tokens carry no role claim, so the JIT path in `ensure_user_from_bunyip` provisioned every subject as `UserRole::default()` (Technician) and never re-roled the row afterward. That 403s the admin-gated PSA routes (per-tenant module enable, SLA policy writes) for accounts that ARE listed in `OAUTH_SUPER_ADMIN_EMAILS`, which is what broke the e2e core-module specs on PR #136 (run #622): auth succeeded but the test account could not enable modules or create an SLA policy.

Consult the existing `super_admin_emails` allowlist (already used fail-closed by the Google login path in `provision_user_from_google`) from the bunyip path: a never-before-seen allowlisted subject provisions straight as super_admin, and an existing allowlisted row is elevated on each login since `upsert_user_from_oidc`'s ON CONFLICT never touches the role. Promotion is idempotent and a no-op for any non-allowlisted user; DB errors degrade to the existing role rather than dropping the session.

#PMS-162

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
nrupard closed this pull request 2026-06-09 17:53:34 +02:00
Some checks are pending
E2E (staging) / Playwright against staging (pull_request) Failing after 28s
Details
Check / fmt + clippy + compile + tests (pull_request) Successful in 1m53s
Required
Details
Create release / Create release from merged PR (pull_request) Has been skipped
Details
E2E / * (pull_request)
Required

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
psa-systems/mokosh-server!139
No description provided.