fix: enforce role authority for user management (#616)

Centralize role-authority enforcement across user management, role management, configuration import, SCIM, GDPR, and MFA mutations. Add regression coverage for delegated custom roles and protect higher-privilege accounts from reset, deletion, or takeover.
2026-08-03 07:46:42 +02:00 · 2026-07-22 01:23:15 +08:00
parent 129e42b95c
commit 1f8a42e548
36 changed files with 4266 additions and 1584 deletions
@@ -3,6 +3,26 @@ import { afterAll, beforeAll, describe, expect, it, vi } from "vitest";
 import { db, schema } from "../../../apps/api/src/db/index.js";
 import { buildTestApp, loginAsAdmin, type TestApp } from "../test-server.js";

+const ADMIN_PERMISSIONS = [
+  "tools:use",
+  "files:own",
+  "files:all",
+  "apikeys:own",
+  "apikeys:all",
+  "pipelines:own",
+  "pipelines:all",
+  "settings:read",
+  "settings:write",
+  "users:manage",
+  "teams:manage",
+  "features:manage",
+  "system:health",
+  "audit:read",
+  "compliance:manage",
+  "webhooks:manage",
+  "security:manage",
+];
+
 let testApp: TestApp;
 let adminToken: string;

@@ -201,7 +221,188 @@ describe("config import with enterprise license", () => {
    expect(res.statusCode).toBe(403);
  });

-  it("dry-run mode returns changes without applying", async () => {
+  it("denies config import to a custom role even when it has every admin permission", async () => {
+    const suffix = Date.now().toString(36);
+    const roleName = `config-health-${suffix}`;
+    const username = `config-health-user-${suffix}`;
+    const settingKey = `configImportAuthzSentinel${suffix}`;
+    let roleId: string | undefined;
+    let userId: string | undefined;
+
+    try {
+      const roleRes = await licensedApp.app.inject({
+        method: "POST",
+        url: "/api/v1/roles",
+        headers: { authorization: `Bearer ${licensedToken}` },
+        payload: { name: roleName, permissions: ADMIN_PERMISSIONS },
+      });
+      if (roleRes.statusCode !== 201) {
+        throw new Error(`Failed to create config test role: ${roleRes.body}`);
+      }
+      roleId = JSON.parse(roleRes.body).id as string;
+
+      const registerRes = await licensedApp.app.inject({
+        method: "POST",
+        url: "/api/auth/register",
+        headers: { authorization: `Bearer ${licensedToken}` },
+        payload: { username, password: "TestPass1", role: roleName },
+      });
+      if (registerRes.statusCode !== 201) {
+        throw new Error(`Failed to create config test user: ${registerRes.body}`);
+      }
+      userId = JSON.parse(registerRes.body).id as string;
+
+      await db
+        .update(schema.users)
+        .set({ mustChangePassword: false })
+        .where(eq(schema.users.id, userId));
+
+      const loginRes = await licensedApp.app.inject({
+        method: "POST",
+        url: "/api/auth/login",
+        payload: { username, password: "TestPass1" },
+      });
+      const actorToken = JSON.parse(loginRes.body).token as string;
+
+      const res = await licensedApp.app.inject({
+        method: "POST",
+        url: "/api/v1/enterprise/config/import",
+        headers: { authorization: `Bearer ${actorToken}` },
+        payload: {
+          dryRun: false,
+          config: {
+            configSchemaVersion: 1,
+            settings: { [settingKey]: "must-not-be-imported" },
+          },
+        },
+      });
+
+      const body = JSON.parse(res.body);
+      const [importedSetting] = await db
+        .select()
+        .from(schema.settings)
+        .where(eq(schema.settings.key, settingKey));
+
+      expect.soft(res.statusCode).toBe(403);
+      expect.soft(body.code).toBe("ESCALATION_DENIED");
+      expect(importedSetting).toBeUndefined();
+    } finally {
+      await db.delete(schema.settings).where(eq(schema.settings.key, settingKey));
+      if (userId) await db.delete(schema.users).where(eq(schema.users.id, userId));
+      if (roleId) await db.delete(schema.roles).where(eq(schema.roles.id, roleId));
+    }
+  });
+
+  it("denies config import through a permission-scoped built-in admin API key", async () => {
+    const suffix = Date.now().toString(36);
+    const settingKey = `configImportScopedKeySentinel${suffix}`;
+    const keyRes = await licensedApp.app.inject({
+      method: "POST",
+      url: "/api/v1/api-keys",
+      headers: { authorization: `Bearer ${licensedToken}` },
+      payload: {
+        name: `config-import-scoped-${suffix}`,
+        permissions: ["system:health"],
+      },
+    });
+    expect(keyRes.statusCode, keyRes.body).toBe(201);
+    const scopedKey = JSON.parse(keyRes.body).key as string;
+
+    try {
+      const res = await licensedApp.app.inject({
+        method: "POST",
+        url: "/api/v1/enterprise/config/import",
+        headers: { authorization: `Bearer ${scopedKey}` },
+        payload: {
+          dryRun: false,
+          config: {
+            configSchemaVersion: 1,
+            settings: { [settingKey]: "must-not-be-imported" },
+          },
+        },
+      });
+      const [importedSetting] = await db
+        .select()
+        .from(schema.settings)
+        .where(eq(schema.settings.key, settingKey));
+
+      expect.soft(res.statusCode).toBe(403);
+      expect.soft(JSON.parse(res.body).code).toBe("ESCALATION_DENIED");
+      expect(importedSetting).toBeUndefined();
+    } finally {
+      await db.delete(schema.settings).where(eq(schema.settings.key, settingKey));
+    }
+  });
+
+  it.each([
+    {
+      caseName: "unknown permissions",
+      roleName: "config-invalid-permission",
+      role: {
+        name: "config-invalid-permission",
+        permissions: ["users:impersonate"],
+      },
+    },
+    {
+      caseName: "unknown tool permission modes",
+      roleName: "config-invalid-tool-mode",
+      role: {
+        name: "config-invalid-tool-mode",
+        permissions: ["tools:use"],
+        toolPermissions: { mode: "everything", allowed: ["compress-image"] },
+      },
+    },
+    {
+      caseName: "invalid role names",
+      roleName: "INVALID ROLE!",
+      role: {
+        name: "INVALID ROLE!",
+        permissions: ["settings:read"],
+      },
+    },
+  ])("rejects $caseName before mutating any configuration", async ({ roleName, role }) => {
+    const suffix = `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
+    const settingKey = `configInvalidRoleSentinel${suffix}`;
+
+    try {
+      const res = await licensedApp.app.inject({
+        method: "POST",
+        url: "/api/v1/enterprise/config/import",
+        headers: { authorization: `Bearer ${licensedToken}` },
+        payload: {
+          dryRun: false,
+          config: {
+            configSchemaVersion: 1,
+            settings: { [settingKey]: "must-not-be-imported" },
+            roles: [role],
+          },
+        },
+      });
+      const [importedSetting] = await db
+        .select()
+        .from(schema.settings)
+        .where(eq(schema.settings.key, settingKey));
+      const [importedRole] = await db
+        .select()
+        .from(schema.roles)
+        .where(eq(schema.roles.name, roleName));
+
+      expect.soft(res.statusCode, res.body).toBe(400);
+      expect.soft(JSON.parse(res.body).error).toBe("Invalid import payload");
+      expect.soft(importedSetting).toBeUndefined();
+      expect(importedRole).toBeUndefined();
+    } finally {
+      await db.delete(schema.settings).where(eq(schema.settings.key, settingKey));
+      await db.delete(schema.roles).where(eq(schema.roles.name, roleName));
+    }
+  });
+
+  it("dry-run reports setting, role, and team changes without mutating them", async () => {
+    const suffix = Date.now().toString(36);
+    const settingKey = `configDryRunSetting${suffix}`;
+    const roleName = `config-dry-run-role-${suffix}`;
+    const teamName = `config-dry-run-team-${suffix}`;
+
    const res = await licensedApp.app.inject({
      method: "POST",
      url: "/api/v1/enterprise/config/import",
@@ -210,7 +411,9 @@ describe("config import with enterprise license", () => {
        dryRun: true,
        config: {
          configSchemaVersion: 1,
-          settings: { testSetting: "hello" },
+          settings: { [settingKey]: "hello" },
+          roles: [{ name: roleName, permissions: ["settings:read"] }],
+          teams: [{ name: teamName }],
        },
      },
    });
@@ -218,11 +421,23 @@ describe("config import with enterprise license", () => {
    const body = JSON.parse(res.body);
    expect(body.dryRun).toBe(true);
    expect(body.changes).toBeDefined();
-    expect(body.changes.settings).toBeGreaterThanOrEqual(1);
+    expect(body.changes).toEqual({ settings: 1, roles: 1, teams: 1 });
    expect(body.details).toBeDefined();
    expect(body.details.settings).toEqual(
-      expect.arrayContaining([expect.objectContaining({ key: "testSetting" })]),
+      expect.arrayContaining([expect.objectContaining({ key: settingKey, action: "create" })]),
    );
+    expect(body.details.roles).toContainEqual({ name: roleName, action: "create" });
+    expect(body.details.teams).toContainEqual({ name: teamName, action: "create" });
+
+    const [setting] = await db
+      .select()
+      .from(schema.settings)
+      .where(eq(schema.settings.key, settingKey));
+    const [role] = await db.select().from(schema.roles).where(eq(schema.roles.name, roleName));
+    const [team] = await db.select().from(schema.teams).where(eq(schema.teams.name, teamName));
+    expect.soft(setting).toBeUndefined();
+    expect.soft(role).toBeUndefined();
+    expect(team).toBeUndefined();
  });

  it("rejects future schema versions", async () => {
@@ -240,7 +455,7 @@ describe("config import with enterprise license", () => {
    expect(body.error).toContain("Unsupported config schema version");
  });

-  it("empty config import succeeds with no changes", async () => {
+  it("allows the full built-in admin to import an empty config", async () => {
    const res = await licensedApp.app.inject({
      method: "POST",
      url: "/api/v1/enterprise/config/import",