fix: enforce role authority for user management (#616)

Centralize role-authority enforcement across user management, role management, configuration import, SCIM, GDPR, and MFA mutations. Add regression coverage for delegated custom roles and protect higher-privilege accounts from reset, deletion, or takeover.

tests/integration/platform/custom-roles-edge-cases.test.ts

@@ -5,6 +5,35 @@ import { buildTestApp, loginAsAdmin, type TestApp } from "../test-server.js";
 
 let testApp: TestApp;
 let adminToken: string;
+let userSequence = 0;
+
+const BASE_USER_PERMISSIONS = [
+  "tools:use",
+  "files:own",
+  "apikeys:own",
+  "pipelines:own",
+  "settings:read",
+];
+
+const ADMIN_PERMISSIONS = [
+  "tools:use",
+  "files:own",
+  "files:all",
+  "apikeys:own",
+  "apikeys:all",
+  "pipelines:own",
+  "pipelines:all",
+  "settings:read",
+  "settings:write",
+  "users:manage",
+  "teams:manage",
+  "features:manage",
+  "system:health",
+  "audit:read",
+  "compliance:manage",
+  "webhooks:manage",
+  "security:manage",
+];
 
 beforeAll(async () => {
   testApp = await buildTestApp();
@@ -44,12 +73,17 @@ async function createUserAndLogin(
   password: string,
   role: string,
 ): Promise<string> {
-  await testApp.app.inject({
+  const registerRes = await testApp.app.inject({
     method: "POST",
     url: "/api/auth/register",
     headers: { authorization: `Bearer ${adminToken}` },
     payload: { username, password, role },
   });
+  if (registerRes.statusCode !== 201) {
+    throw new Error(
+      `createUserAndLogin registration failed (${registerRes.statusCode}): ${registerRes.body}`,
+    );
+  }
   await db
     .update(schema.users)
     .set({ mustChangePassword: false })
@@ -63,6 +97,47 @@ async function createUserAndLogin(
   return JSON.parse(loginRes.body).token as string;
 }
 
+async function createTargetUser(
+  prefix: string,
+  role: string,
+  options: { mfaEnabled?: boolean } = {},
+): Promise<{ id: string; password: string; username: string }> {
+  userSequence += 1;
+  const username = `${prefix}-${Date.now()}-${userSequence}`;
+  const password = "TargetPass1";
+  const registerRes = await testApp.app.inject({
+    method: "POST",
+    url: "/api/auth/register",
+    headers: { authorization: `Bearer ${adminToken}` },
+    payload: { username, password, role },
+  });
+  if (registerRes.statusCode !== 201) {
+    throw new Error(`createTargetUser failed (${registerRes.statusCode}): ${registerRes.body}`);
+  }
+
+  const id = JSON.parse(registerRes.body).id as string;
+  await db
+    .update(schema.users)
+    .set({
+      mustChangePassword: false,
+      ...(options.mfaEnabled
+        ? {
+            totpEnabled: true,
+            totpSecret: "target-authority-test-secret",
+            recoveryCodesHash: "target-authority-test-recovery-codes",
+          }
+        : {}),
+    })
+    .where(eq(schema.users.id, id));
+
+  return { id, password, username };
+}
+
+async function getUserById(id: string) {
+  const [user] = await db.select().from(schema.users).where(eq(schema.users.id, id));
+  return user;
+}
+
 // ---------------------------------------------------------------------------
 // Name validation (5 tests)
 // ---------------------------------------------------------------------------
@@ -278,3 +353,325 @@ describe("functional permissions", () => {
     expect(auditRes.statusCode).toBe(403);
   });
 });
+
+// ---------------------------------------------------------------------------
+// Target role authority
+// ---------------------------------------------------------------------------
+describe("target role authority", () => {
+  let managerRole: string;
+  let subordinateRole: string;
+  let alternateSubordinateRole: string;
+  let managerToken: string;
+  let fullPermissionManagerToken: string;
+
+  beforeAll(async () => {
+    const suffix = Date.now();
+    managerRole = `mgr-${suffix}`;
+    subordinateRole = `sub-${suffix}`;
+    alternateSubordinateRole = `alt-${suffix}`;
+
+    await createRole(managerRole, [...BASE_USER_PERMISSIONS, "users:manage"]);
+    await createRole(subordinateRole, BASE_USER_PERMISSIONS);
+    await createRole(alternateSubordinateRole, BASE_USER_PERMISSIONS);
+    managerToken = await createUserAndLogin(`manager-${suffix}`, "ManagerPass1", managerRole);
+
+    const fullPermissionManagerRole = `full-mgr-${suffix}`;
+    await createRole(fullPermissionManagerRole, ADMIN_PERMISSIONS);
+    fullPermissionManagerToken = await createUserAndLogin(
+      `full-manager-${suffix}`,
+      "FullManagerPass1",
+      fullPermissionManagerRole,
+    );
+  });
+
+  it("denies a custom role with all 17 admin permissions from managing built-in admins", async () => {
+    expect(ADMIN_PERMISSIONS).toHaveLength(17);
+
+    const demotionTarget = await createTargetUser("full-deny-demote-admin", "admin");
+    const passwordTarget = await createTargetUser("full-deny-reset-admin", "admin");
+    const deleteTarget = await createTargetUser("full-deny-delete-admin", "admin");
+    const mfaTarget = await createTargetUser("full-deny-mfa-admin", "admin", {
+      mfaEnabled: true,
+    });
+    const passwordBefore = await getUserById(passwordTarget.id);
+
+    const demotionResponse = await testApp.app.inject({
+      method: "PUT",
+      url: `/api/auth/users/${demotionTarget.id}`,
+      headers: { authorization: `Bearer ${fullPermissionManagerToken}` },
+      payload: { role: subordinateRole },
+    });
+    const passwordResponse = await testApp.app.inject({
+      method: "POST",
+      url: `/api/auth/users/${passwordTarget.id}/reset-password`,
+      headers: { authorization: `Bearer ${fullPermissionManagerToken}` },
+      payload: { newPassword: "UnauthorizedReset1" },
+    });
+    const deleteResponse = await testApp.app.inject({
+      method: "DELETE",
+      url: `/api/auth/users/${deleteTarget.id}`,
+      headers: { authorization: `Bearer ${fullPermissionManagerToken}` },
+    });
+    const mfaResponse = await testApp.app.inject({
+      method: "POST",
+      url: `/api/auth/users/${mfaTarget.id}/mfa/reset`,
+      headers: { authorization: `Bearer ${fullPermissionManagerToken}` },
+    });
+
+    for (const response of [demotionResponse, passwordResponse, deleteResponse, mfaResponse]) {
+      expect.soft(response.statusCode).toBe(403);
+      expect.soft(JSON.parse(response.body).code).toBe("ESCALATION_DENIED");
+    }
+
+    const [demotionAfter, passwordAfter, deleteAfter, mfaAfter] = await Promise.all([
+      getUserById(demotionTarget.id),
+      getUserById(passwordTarget.id),
+      getUserById(deleteTarget.id),
+      getUserById(mfaTarget.id),
+    ]);
+    expect.soft(demotionAfter?.role).toBe("admin");
+    expect.soft(passwordAfter?.passwordHash).toBe(passwordBefore?.passwordHash);
+    expect.soft(passwordAfter?.mustChangePassword).toBe(false);
+    expect.soft(deleteAfter?.role).toBe("admin");
+    expect(mfaAfter).toMatchObject({
+      role: "admin",
+      totpEnabled: true,
+      totpSecret: "target-authority-test-secret",
+      recoveryCodesHash: "target-authority-test-recovery-codes",
+    });
+  });
+
+  it("denies a custom manager demoting an admin and preserves the admin role", async () => {
+    const target = await createTargetUser("deny-demote-admin", "admin");
+
+    const response = await testApp.app.inject({
+      method: "PUT",
+      url: `/api/auth/users/${target.id}`,
+      headers: { authorization: `Bearer ${managerToken}` },
+      payload: { role: subordinateRole },
+    });
+    const targetAfter = await getUserById(target.id);
+
+    expect.soft(response.statusCode).toBe(403);
+    expect.soft(JSON.parse(response.body).code).toBe("ESCALATION_DENIED");
+    expect(targetAfter?.role).toBe("admin");
+  });
+
+  it("denies a custom manager resetting an admin password and preserves credentials", async () => {
+    const target = await createTargetUser("deny-reset-admin", "admin");
+    const targetBefore = await getUserById(target.id);
+
+    const response = await testApp.app.inject({
+      method: "POST",
+      url: `/api/auth/users/${target.id}/reset-password`,
+      headers: { authorization: `Bearer ${managerToken}` },
+      payload: { newPassword: "ReplacementPass1" },
+    });
+    const targetAfter = await getUserById(target.id);
+
+    expect.soft(response.statusCode).toBe(403);
+    expect.soft(JSON.parse(response.body).code).toBe("ESCALATION_DENIED");
+    expect(targetAfter?.passwordHash).toBe(targetBefore?.passwordHash);
+    expect(targetAfter?.mustChangePassword).toBe(false);
+  });
+
+  it("denies a custom manager deleting an admin and preserves the account", async () => {
+    const target = await createTargetUser("deny-delete-admin", "admin");
+
+    const response = await testApp.app.inject({
+      method: "DELETE",
+      url: `/api/auth/users/${target.id}`,
+      headers: { authorization: `Bearer ${managerToken}` },
+    });
+    const targetAfter = await getUserById(target.id);
+
+    expect.soft(response.statusCode).toBe(403);
+    expect.soft(JSON.parse(response.body).code).toBe("ESCALATION_DENIED");
+    expect(targetAfter).toBeDefined();
+    expect(targetAfter?.role).toBe("admin");
+  });
+
+  it("denies a custom manager resetting admin MFA and preserves MFA state", async () => {
+    const target = await createTargetUser("deny-mfa-admin", "admin", { mfaEnabled: true });
+
+    const response = await testApp.app.inject({
+      method: "POST",
+      url: `/api/auth/users/${target.id}/mfa/reset`,
+      headers: { authorization: `Bearer ${managerToken}` },
+    });
+    const targetAfter = await getUserById(target.id);
+
+    expect.soft(response.statusCode).toBe(403);
+    expect.soft(JSON.parse(response.body).code).toBe("ESCALATION_DENIED");
+    expect(targetAfter).toMatchObject({
+      role: "admin",
+      totpEnabled: true,
+      totpSecret: "target-authority-test-secret",
+      recoveryCodesHash: "target-authority-test-recovery-codes",
+    });
+  });
+
+  it("protects a disabled admin from a custom manager while allowing built-in admin recovery", async () => {
+    const target = await createTargetUser("disabled-admin-recovery", "admin");
+    await db
+      .update(schema.users)
+      .set({ role: "disabled:admin" })
+      .where(eq(schema.users.id, target.id));
+    const targetBefore = await getUserById(target.id);
+
+    const deniedResponse = await testApp.app.inject({
+      method: "POST",
+      url: `/api/auth/users/${target.id}/reset-password`,
+      headers: { authorization: `Bearer ${managerToken}` },
+      payload: { newPassword: "UnauthorizedReset1" },
+    });
+    const targetAfterDenial = await getUserById(target.id);
+
+    expect.soft(deniedResponse.statusCode).toBe(403);
+    expect.soft(JSON.parse(deniedResponse.body).code).toBe("ESCALATION_DENIED");
+    expect.soft(targetAfterDenial?.role).toBe("disabled:admin");
+    expect.soft(targetAfterDenial?.passwordHash).toBe(targetBefore?.passwordHash);
+    expect.soft(targetAfterDenial?.mustChangePassword).toBe(false);
+
+    const recoveryResponse = await testApp.app.inject({
+      method: "POST",
+      url: `/api/auth/users/${target.id}/reset-password`,
+      headers: { authorization: `Bearer ${adminToken}` },
+      payload: { newPassword: "AdminRecovery1" },
+    });
+    const targetAfterRecovery = await getUserById(target.id);
+
+    expect(recoveryResponse.statusCode).toBe(200);
+    expect(targetAfterRecovery?.role).toBe("disabled:admin");
+    expect(targetAfterRecovery?.passwordHash).not.toBe(targetBefore?.passwordHash);
+    expect(targetAfterRecovery?.mustChangePassword).toBe(true);
+  });
+
+  it("allows a custom manager to change a subordinate custom-role user", async () => {
+    const target = await createTargetUser("allow-demote-sub", subordinateRole);
+
+    const response = await testApp.app.inject({
+      method: "PUT",
+      url: `/api/auth/users/${target.id}`,
+      headers: { authorization: `Bearer ${managerToken}` },
+      payload: { role: alternateSubordinateRole },
+    });
+    const targetAfter = await getUserById(target.id);
+
+    expect(response.statusCode).toBe(200);
+    expect(targetAfter?.role).toBe(alternateSubordinateRole);
+  });
+
+  it("allows a custom manager to reset a subordinate custom-role user password", async () => {
+    const target = await createTargetUser("allow-reset-sub", subordinateRole);
+    const targetBefore = await getUserById(target.id);
+
+    const response = await testApp.app.inject({
+      method: "POST",
+      url: `/api/auth/users/${target.id}/reset-password`,
+      headers: { authorization: `Bearer ${managerToken}` },
+      payload: { newPassword: "ReplacementPass1" },
+    });
+    const targetAfter = await getUserById(target.id);
+
+    expect(response.statusCode).toBe(200);
+    expect(targetAfter?.passwordHash).not.toBe(targetBefore?.passwordHash);
+    expect(targetAfter?.mustChangePassword).toBe(true);
+  });
+
+  it("allows a custom manager to delete a subordinate custom-role user", async () => {
+    const target = await createTargetUser("allow-delete-sub", subordinateRole);
+
+    const response = await testApp.app.inject({
+      method: "DELETE",
+      url: `/api/auth/users/${target.id}`,
+      headers: { authorization: `Bearer ${managerToken}` },
+    });
+    const targetAfter = await getUserById(target.id);
+
+    expect(response.statusCode).toBe(200);
+    expect(targetAfter).toBeUndefined();
+  });
+
+  it("allows a custom manager to reset subordinate custom-role user MFA", async () => {
+    const target = await createTargetUser("allow-mfa-sub", subordinateRole, { mfaEnabled: true });
+
+    const response = await testApp.app.inject({
+      method: "POST",
+      url: `/api/auth/users/${target.id}/mfa/reset`,
+      headers: { authorization: `Bearer ${managerToken}` },
+    });
+    const targetAfter = await getUserById(target.id);
+
+    expect(response.statusCode).toBe(200);
+    expect(targetAfter).toMatchObject({
+      totpEnabled: false,
+      totpSecret: null,
+      recoveryCodesHash: null,
+    });
+  });
+
+  it("allows an admin to demote an equal admin", async () => {
+    const target = await createTargetUser("allow-demote-peer", "admin");
+
+    const response = await testApp.app.inject({
+      method: "PUT",
+      url: `/api/auth/users/${target.id}`,
+      headers: { authorization: `Bearer ${adminToken}` },
+      payload: { role: subordinateRole },
+    });
+    const targetAfter = await getUserById(target.id);
+
+    expect(response.statusCode).toBe(200);
+    expect(targetAfter?.role).toBe(subordinateRole);
+  });
+
+  it("allows an admin to reset an equal admin password", async () => {
+    const target = await createTargetUser("allow-reset-peer", "admin");
+    const targetBefore = await getUserById(target.id);
+
+    const response = await testApp.app.inject({
+      method: "POST",
+      url: `/api/auth/users/${target.id}/reset-password`,
+      headers: { authorization: `Bearer ${adminToken}` },
+      payload: { newPassword: "ReplacementPass1" },
+    });
+    const targetAfter = await getUserById(target.id);
+
+    expect(response.statusCode).toBe(200);
+    expect(targetAfter?.passwordHash).not.toBe(targetBefore?.passwordHash);
+    expect(targetAfter?.mustChangePassword).toBe(true);
+  });
+
+  it("allows an admin to delete an equal admin", async () => {
+    const target = await createTargetUser("allow-delete-peer", "admin");
+
+    const response = await testApp.app.inject({
+      method: "DELETE",
+      url: `/api/auth/users/${target.id}`,
+      headers: { authorization: `Bearer ${adminToken}` },
+    });
+    const targetAfter = await getUserById(target.id);
+
+    expect(response.statusCode).toBe(200);
+    expect(targetAfter).toBeUndefined();
+  });
+
+  it("allows an admin to reset equal admin MFA", async () => {
+    const target = await createTargetUser("allow-mfa-peer", "admin", { mfaEnabled: true });
+
+    const response = await testApp.app.inject({
+      method: "POST",
+      url: `/api/auth/users/${target.id}/mfa/reset`,
+      headers: { authorization: `Bearer ${adminToken}` },
+    });
+    const targetAfter = await getUserById(target.id);
+
+    expect(response.statusCode).toBe(200);
+    expect(targetAfter).toMatchObject({
+      totpEnabled: false,
+      totpSecret: null,
+      recoveryCodesHash: null,
+    });
+  });
+});