psa-systems/mokosh-server
Watch
9
0
Fork
You've already forked mokosh-server
 1
Code Issues Pull requests Projects Releases 10 Packages Wiki Activity Actions

fix(auth): enforce role ceiling on create_user (PMS-503) #380

Merged
Claude-Run merged 1 commit from fix/PMS-503-create-user-role-ceiling into main 2026-06-26 13:10:46 +02:00
Conversation 0 Commits 1 Files changed 2 +47
Claude-Run commented 2026-06-26 13:04:39 +02:00
Member
Copy link

create_user gated only on is_admin() and then bound request.role
straight into the INSERT, so a tenant admin could mint a brand-new
super_admin account (a platform-level row with cross-tenant /tenants
access). This mirrors the missing ceiling in update_user and is
inconsistent with the invitations flow, which already excludes
super_admin from grantable roles.

Add UserRole::privilege_rank / UserRole::can_grant to the shared
types crate and enforce it in the create_user handler: a caller may only
create a user whose role is at or below their own privilege, so
super_admin (the only rank-3 role) can only be granted by an existing
super_admin.

#PMS-503

create_user gated only on `is_admin()` and then bound `request.role` straight into the INSERT, so a tenant `admin` could mint a brand-new `super_admin` account (a platform-level row with cross-tenant `/tenants` access). This mirrors the missing ceiling in update_user and is inconsistent with the invitations flow, which already excludes `super_admin` from grantable roles. Add `UserRole::privilege_rank` / `UserRole::can_grant` to the shared types crate and enforce it in the create_user handler: a caller may only create a user whose role is at or below their own privilege, so `super_admin` (the only rank-3 role) can only be granted by an existing `super_admin`. #PMS-503
fix(auth): enforce role ceiling on create_user (PMS-503)
All checks were successful
E2E / Playwright against staging (pull_request) Successful in 25s
Details
Check / fmt + clippy + build + tests (pull_request) Successful in 1m17s
Details
Integration / integration tests (pull_request) Successful in 5m37s
Details
Create release / Gate (release-branch merges only) (pull_request) Successful in 1s
Details
Create release / Create release from merged PR (pull_request) Has been skipped
Details
10f4a2c7e2 
create_user gated only on `is_admin()` and then bound `request.role`
straight into the INSERT, so a tenant `admin` could mint a brand-new
`super_admin` account (a platform-level row with cross-tenant `/tenants`
access). This mirrors the missing ceiling in update_user and is
inconsistent with the invitations flow, which already excludes
`super_admin` from grantable roles.

Add `UserRole::privilege_rank` / `UserRole::can_grant` to the shared
types crate and enforce it in the create_user handler: a caller may only
create a user whose role is at or below their own privilege, so
`super_admin` (the only rank-3 role) can only be granted by an existing
`super_admin`.

#PMS-503
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
psa-systems/mokosh-server!380
No description provided.