Fature/add new roles restriction for user actions - #84
Conversation
|
| ); | ||
|
|
||
| var customUserGroupsMatch = params.getUserGroups().stream().anyMatch(group -> | ||
| restrictions.getGroups().getWhitelistedRoles().stream().anyMatch(group::equals) |
There was a problem hiding this comment.
If case we decide to keep the validation here, the matching function should be endsWith, since we're matching group suffixes, not entire group values.
| restrictions.getGroups().getWhitelistedRoles().stream().anyMatch(group::equals) | ||
| ); | ||
|
|
||
| return defaultUserGroupsMatch || customUserGroupsMatch; |
There was a problem hiding this comment.
The correct expression isn't defaultUserGroupsMatch || customUserGroupsMatch. With this, one user with role wrongprefix-USER could provision if there exists a USER whitelisted suffix and the component provisioner configuration doesn't define wrongprefix as a valid prefix.
The user group needs to match at least one of the prefixes configured, and macth at least one of the suffixes configured, or one of the whitelisted item suffixes.
matchAtLeastOneConfiguredPrefix && (matchAtLeastOneConfiguredSuffix || matchAtLeastOneWhitelistedSuffix)
|
A new approach is agreed, so this PR is not required anymore. |
2 participants
No description provided.