fix(auth): preserve invite role over the Bunyip subscriber floor #324

Merged

David merged 2 commits from fix/PMS-458-preserve-invite-role-over-subscriber-floor into main

2026-06-22 02:25:18 +02:00

David commented

2026-06-21 05:44:58 +02:00

Owner

PMS-447 added a single-tenancy admin floor that translates a subscriber (or unknown) Bunyip claim to admin, on the premise that every signed-in Bunyip user owns their own one-person tenant. That premise does not hold for a user accepting an invite into a SHARED org tenant: the inviting admin's chosen role (e.g. manager) is a deliberate least-privilege grant, and silently flooring it up to admin is an unintended privilege elevation that contradicts the invite.

Gate the floor on invite presence in place_bunyip_user: when this placement consumes a fresh invite, the invite role stands as-is and only a platform-level Bunyip admin claim still overrides to super_admin; non-invite placements keep the PMS-447 floor unchanged. This restores the failing integration test invited_user_lands_in_inviting_tenant_with_invite_role while leaving the PMS-447 floor unit tests (which cover the non-invite local-role path) green.

#PMS-458

PMS-447 added a single-tenancy admin floor that translates a `subscriber` (or unknown) Bunyip claim to `admin`, on the premise that every signed-in Bunyip user owns their own one-person tenant. That premise does not hold for a user accepting an invite into a SHARED org tenant: the inviting admin's chosen role (e.g. `manager`) is a deliberate least-privilege grant, and silently flooring it up to `admin` is an unintended privilege elevation that contradicts the invite. Gate the floor on invite presence in `place_bunyip_user`: when this placement consumes a fresh invite, the invite role stands as-is and only a platform-level Bunyip `admin` claim still overrides to `super_admin`; non-invite placements keep the PMS-447 floor unchanged. This restores the failing integration test `invited_user_lands_in_inviting_tenant_with_invite_role` while leaving the PMS-447 floor unit tests (which cover the non-invite local-role path) green. #PMS-458

David added 1 commit

2026-06-21 05:44:58 +02:00

fix(auth): preserve invite role over the Bunyip subscriber floor

E2E / Playwright against staging (pull_request) Successful in 42s

Details

Check / fmt + clippy + compile + unit/doc tests (pull_request) Successful in 1m13s

Details

Integration / integration tests (pull_request) Successful in 6m28s

Details

83bf97e5f6

PMS-447 added a single-tenancy admin floor that translates a `subscriber` (or unknown) Bunyip claim to `admin`, on the premise that every signed-in Bunyip user owns their own one-person tenant. That premise does not hold for a user accepting an invite into a SHARED org tenant: the inviting admin's chosen role (e.g. `manager`) is a deliberate least-privilege grant, and silently flooring it up to `admin` is an unintended privilege elevation that contradicts the invite.

Gate the floor on invite presence in `place_bunyip_user`: when this placement consumes a fresh invite, the invite role stands as-is and only a platform-level Bunyip `admin` claim still overrides to `super_admin`; non-invite placements keep the PMS-447 floor unchanged. This restores the failing integration test `invited_user_lands_in_inviting_tenant_with_invite_role` while leaving the PMS-447 floor unit tests (which cover the non-invite local-role path) green.

#PMS-458

David added 1 commit

2026-06-22 02:14:06 +02:00

Merge origin/main into fix/PMS-458-preserve-invite-role-over-subscriber-floor

E2E / Playwright against staging (pull_request) Successful in 1m3s

Details

Check / fmt + clippy + build + tests (pull_request) Successful in 2m40s

Details

Integration / integration tests (pull_request) Successful in 8m28s

Details

Create release / Create release from merged PR (pull_request) Successful in 3s

Details

0843268301

Resolve comment-only conflict in src/modules/auth/middleware.rs. main already landed the identical invite-role-gating code via 1e0efe3; the surviving difference is the explanatory comment, kept as the PMS-458 wording. BUNYIP-141 given_name/family_name plumbing from main merges in cleanly.

#PMS-458