fix: enforce role authority for user management (#616)

Centralize role-authority enforcement across user management, role management, configuration import, SCIM, GDPR, and MFA mutations. Add regression coverage for delegated custom roles and protect higher-privilege accounts from reset, deletion, or takeover.
2026-08-03 07:46:42 +02:00 · 2026-07-22 01:23:15 +08:00
parent 129e42b95c
commit 1f8a42e548
36 changed files with 4266 additions and 1584 deletions
@@ -5816,7 +5816,8 @@ paths:
      tags:
        - Auth
      summary: user बनाएं
-      description: users:manage permission आवश्यक है।
+      description: |
+        Requires users:manage permission. The assigned role must be within the actor's effective role authority, including hierarchy, permissions, tool access, and any API-key scope.
      security:
        - bearerAuth: []
      requestBody:
@@ -5887,7 +5888,8 @@ paths:
      tags:
        - Auth
      summary: user अपडेट करें
-      description: users:manage permission आवश्यक है।
+      description: |
+        Requires users:manage permission and authority over the target's current role. Any newly assigned role must also be within the actor's effective hierarchy, permissions, tool access, and API-key scope.
      security:
        - bearerAuth: []
      parameters:
@@ -5942,7 +5944,8 @@ paths:
      tags:
        - Auth
      summary: user हटाएं
-      description: users:manage permission आवश्यक है।
+      description: |
+        Requires users:manage permission and authority over the target's current role, including hierarchy, permissions, tool access, and any API-key scope. Self-deletion is not allowed.
      security:
        - bearerAuth: []
      parameters:
@@ -5980,7 +5983,8 @@ paths:
      tags:
        - Auth
      summary: user password रीसेट करें
-      description: users:manage permission आवश्यक है।
+      description: |
+        Reset a local user's password. Requires users:manage permission and authority over the target's current role, including hierarchy, permissions, tool access, and any API-key scope.
      security:
        - bearerAuth: []
      parameters:
@@ -7158,9 +7162,10 @@ paths:
        - Roles
      summary: एक कस्टम role बनाएं
      description: |
-        निर्दिष्ट permissions के साथ एक नया कस्टम role बनाएं। Role नाम
-        2-30 वर्ण, हाइफ़न और अंडरस्कोर के साथ लोअरकेस अल्फ़ान्यूमेरिक होने चाहिए।
-        security:manage permission आवश्यक है।
+        Create a new custom role with specified permissions. Role names must be
+        2-30 characters, lowercase alphanumeric with hyphens and underscores.
+        Requires security:manage permission. The new role's permissions and tool
+        access must be contained by the actor's effective authority.
      security:
        - bearerAuth: []
      requestBody:
@@ -7190,7 +7195,8 @@ paths:
                    Permission strings. Valid values: tools:use, files:own, files:all,
                    apikeys:own, apikeys:all, pipelines:own, pipelines:all,
                    settings:read, settings:write, users:manage, teams:manage,
-                    features:manage, system:health, audit:read, security:manage
+                    features:manage, system:health, audit:read, compliance:manage,
+                    webhooks:manage, security:manage
      responses:
        '201':
          description: Role created
@@ -7243,8 +7249,10 @@ paths:
        - Roles
      summary: एक कस्टम role अपडेट करें
      description: |
-        एक कस्टम role का नाम, description, या permissions अपडेट करें। बिल्ट-इन
-        roles संशोधित नहीं किए जा सकते। security:manage permission आवश्यक है।
+        Update name, description, or permissions of a custom role. Built-in
+        roles cannot be modified. Requires security:manage permission and
+        authority over the current role; the resulting permissions and tool
+        access must remain contained by the actor's effective authority.
      security:
        - bearerAuth: []
      parameters:
@@ -7318,9 +7326,10 @@ paths:
        - Roles
      summary: एक कस्टम role हटाएं
      description: |
-        एक कस्टम role हटाएं। इस role को असाइन किए गए Users को
-        डिफ़ॉल्ट "user" role में पुन: असाइन किया जाता है। बिल्ट-इन roles हटाए नहीं जा सकते। इसके लिए
-        security:manage permission आवश्यक है।
+        Delete a custom role. Users assigned to this role are reassigned to the
+        default "user" role. Built-in roles cannot be deleted. Requires
+        security:manage permission, authority over the current role, and
+        authority to assign the fallback role.
      security:
        - bearerAuth: []
      parameters:
@@ -12110,6 +12119,60 @@ paths:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedError'
+  /api/v1/tools/image/rounded-crop:
+    post:
+      operationId: roundedCrop
+      tags:
+        - Tools
+      summary: Rounded crop
+      description: Crop an image to a rounded square or squircle with transparent corners, optional border, and adjustable zoom/offset.
+      security:
+        - bearerAuth: []
+      requestBody:
+        required: true
+        content:
+          multipart/form-data:
+            schema:
+              type: object
+              required:
+                - file
+              properties:
+                file:
+                  type: string
+                  format: binary
+                  description: Image file to process
+                settings:
+                  type: string
+                  description: |
+                    JSON string with options:
+                    - `shape` (string, default "rounded-square") - "rounded-square" or "squircle"
+                    - `cornerRadius` (number 0-50, default 25) - Corner radius as a percent of the shorter side (rounded-square only)
+                    - `zoom` (number 1-5, default 1) - Zoom factor (>=1 crops tighter)
+                    - `offsetX` (number 0-1, default 0.5) - Horizontal center position
+                    - `offsetY` (number 0-1, default 0.5) - Vertical center position
+                    - `borderWidth` (integer 0-200, default 0) - Border width in pixels
+                    - `borderColor` (string, default "#ffffff") - Border hex color
+                    - `background` (string, default "transparent") - "transparent" or a hex color for corners
+                    - `outputSize` (integer 16-4096, optional) - Final square dimension in pixels
+      responses:
+        '200':
+          description: Processed image
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ToolResponse'
+        '400':
+          description: Invalid input
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+        '401':
+          description: Authentication required
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/UnauthorizedError'
  /api/v1/tools/image/duotone:
    post:
      operationId: duotone
@@ -17794,7 +17857,8 @@ paths:
      tags:
        - Auth
      summary: user MFA रीसेट करें
-      description: एक user के MFA नामांकन का Admin रीसेट। users:manage permission आवश्यक है।
+      description: |
+        Reset a user's MFA enrollment. Requires users:manage permission and authority over the target's current role, including hierarchy, permissions, tool access, and any API-key scope.
      security:
        - bearerAuth: []
      parameters:
@@ -18121,7 +18185,8 @@ paths:
      tags:
        - Enterprise
      summary: SCIM token बनाएं
-      description: एक SCIM bearer token जनरेट करें। users:manage permission और enterprise SCIM feature आवश्यक है।
+      description: |
+        Generate a global SCIM bearer token. Requires the enterprise SCIM feature and full effective built-in administrator authority; custom roles and API keys missing any administrator permission do not qualify. Legacy unversioned tokens are invalid and must be reissued as v2 tokens.
      security:
        - bearerAuth: []
      responses:
@@ -18134,7 +18199,8 @@ paths:
      tags:
        - Enterprise
      summary: SCIM token रद्द करें
-      description: वर्तमान SCIM bearer token रद्द करें। users:manage permission और enterprise SCIM feature आवश्यक है।
+      description: |
+        Revoke the global SCIM bearer token. Requires the enterprise SCIM feature and full effective built-in administrator authority; custom roles and API keys missing any administrator permission do not qualify.
      security:
        - bearerAuth: []
      responses:
@@ -18341,7 +18407,8 @@ paths:
      tags:
        - Enterprise
      summary: configuration आयात करें
-      description: instance configuration, कस्टम roles, और teams आयात करें। system:health permission आवश्यक है।
+      description: |
+        Import instance configuration, custom roles, and teams. Requires full effective built-in administrator authority; custom roles and API keys missing any administrator permission do not qualify.
      security:
        - bearerAuth: []
      responses:
@@ -18585,7 +18652,8 @@ paths:
      tags:
        - Enterprise
      summary: user data पर्ज करें
-      description: स्पष्ट पुष्टि के बाद एक user का data स्थायी रूप से पर्ज करें। compliance:manage permission आवश्यक है।
+      description: |
+        Permanently purge a user's data after explicit confirmation. Requires compliance:manage permission and authority over the target's current role, including hierarchy, permissions, tool access, and any API-key scope.
      security:
        - bearerAuth: []
      parameters:
@@ -18599,6 +18667,8 @@ paths:
          description: User purged
        '400':
          description: Confirmation required
+        '403':
+          description: Feature not licensed, insufficient permission, or target role beyond actor authority
        '409':
          description: User or team is under legal hold
  /api/v1/enterprise/teams/{id}/purge:
@@ -18607,7 +18677,8 @@ paths:
      tags:
        - Enterprise
      summary: team data पर्ज करें
-      description: स्पष्ट पुष्टि के बाद एक team का data स्थायी रूप से पर्ज करें। compliance:manage permission आवश्यक है।
+      description: |
+        Permanently purge a team's data after explicit confirmation. Requires compliance:manage permission and authority over every member's current role, including hierarchy, permissions, tool access, and any API-key scope. A team containing the actor cannot be purged.
      security:
        - bearerAuth: []
      parameters:
@@ -18621,6 +18692,8 @@ paths:
          description: Team purged
        '400':
          description: Confirmation required
+        '403':
+          description: Feature not licensed, insufficient permission, or a member role beyond actor authority
        '409':
          description: Team is under legal hold
  /api/v1/admin/version:
@@ -19546,34 +19619,18 @@ x-i18n:
      sourceHash: f06da128c342
      provenance: machine
      outputHash: ee4fc9fef8a4
-    paths./api/auth/register.post.description:
-      sourceHash: 34d5a11733bd
-      provenance: machine
-      outputHash: ca30c0150768
    paths./api/auth/users/{id}.put.summary:
      sourceHash: 602b8b1607b0
      provenance: machine
      outputHash: a80d88e0b5d2
-    paths./api/auth/users/{id}.put.description:
-      sourceHash: 34d5a11733bd
-      provenance: machine
-      outputHash: ca30c0150768
    paths./api/auth/users/{id}.delete.summary:
      sourceHash: 58363fd94240
      provenance: machine
      outputHash: 83e2cc37a32d
-    paths./api/auth/users/{id}.delete.description:
-      sourceHash: 34d5a11733bd
-      provenance: machine
-      outputHash: ca30c0150768
    paths./api/auth/users/{id}/reset-password.post.summary:
      sourceHash: aae899c2d3ad
      provenance: machine
      outputHash: b42e554ee28d
-    paths./api/auth/users/{id}/reset-password.post.description:
-      sourceHash: 34d5a11733bd
-      provenance: machine
-      outputHash: ca30c0150768
    paths./api/v1/api-keys.get.summary:
      sourceHash: ad0527749f03
      provenance: machine
@@ -19738,26 +19795,14 @@ x-i18n:
      sourceHash: 6dd06b2529d4
      provenance: machine
      outputHash: 20b639a2c3dc
-    paths./api/v1/roles.post.description:
-      sourceHash: d740216038e7
-      provenance: machine
-      outputHash: 52e2d30328f9
    paths./api/v1/roles/{id}.put.summary:
      sourceHash: 6c0cda1bc967
      provenance: machine
      outputHash: f823846ad3b6
-    paths./api/v1/roles/{id}.put.description:
-      sourceHash: e06c42a9c3ed
-      provenance: machine
-      outputHash: b86914cd517d
    paths./api/v1/roles/{id}.delete.summary:
      sourceHash: d5a3ab01055a
      provenance: machine
      outputHash: f038a74fc497
-    paths./api/v1/roles/{id}.delete.description:
-      sourceHash: b4c1c8c0c9e0
-      provenance: machine
-      outputHash: 25422003bd1a
    paths./api/v1/tools/video/convert-video.post.summary:
      sourceHash: b4defe1d6906
      provenance: machine
@@ -21338,10 +21383,6 @@ x-i18n:
      sourceHash: c765204eb72c
      provenance: machine
      outputHash: 885f22649f10
-    paths./api/auth/users/{id}/mfa/reset.post.description:
-      sourceHash: 9d650aeb7d10
-      provenance: machine
-      outputHash: 63b464cfeb05
    paths./api/auth/oidc/login.get.summary:
      sourceHash: bac046b3ef24
      provenance: machine
@@ -21466,18 +21507,10 @@ x-i18n:
      sourceHash: e550c4aaeecf
      provenance: machine
      outputHash: a35ff7a09ebc
-    paths./api/v1/enterprise/scim/token.post.description:
-      sourceHash: 39d3b5d5066b
-      provenance: machine
-      outputHash: 02b4ba77a723
    paths./api/v1/enterprise/scim/token.delete.summary:
      sourceHash: e57912d50189
      provenance: machine
      outputHash: 632088aed2e8
-    paths./api/v1/enterprise/scim/token.delete.description:
-      sourceHash: 412b38ac0141
-      provenance: machine
-      outputHash: 4365e54244b1
    paths./api/v1/scim/v2/ServiceProviderConfig.get.summary:
      sourceHash: 6d9bb054fb7b
      provenance: machine
@@ -21602,10 +21635,6 @@ x-i18n:
      sourceHash: 8a507f40b80f
      provenance: machine
      outputHash: a35b2c408440
-    paths./api/v1/enterprise/config/import.post.description:
-      sourceHash: cf4809a9459d
-      provenance: machine
-      outputHash: 7298ab6578d7
    paths./api/v1/enterprise/ip-allowlist.get.summary:
      sourceHash: 8756df674b27
      provenance: machine
@@ -21714,18 +21743,10 @@ x-i18n:
      sourceHash: 09c40d574cc0
      provenance: machine
      outputHash: b1d2bfde9537
-    paths./api/v1/enterprise/users/{id}/purge.delete.description:
-      sourceHash: 6db9ed4dabf1
-      provenance: machine
-      outputHash: 40ae1b27e4ed
    paths./api/v1/enterprise/teams/{id}/purge.delete.summary:
      sourceHash: e5f557c6db8b
      provenance: machine
      outputHash: a11ae49bffa6
-    paths./api/v1/enterprise/teams/{id}/purge.delete.description:
-      sourceHash: 5bcd69dee315
-      provenance: machine
-      outputHash: 7192acd5442a
    paths./api/v1/admin/version.get.summary:
      sourceHash: 1fa5f3f5fa4a
      provenance: machine