fix: keep SUPER_ADMIN_GROUP as app_super_admin so resource auto-provisioning nesting works

api_directory_admin nests permission.SUPER_ADMIN_GROUP into every new resource's
_admin group. Changing it to the not-yet-existing 'god_admin' made that nesting
no-op, leaving the creator as the sole member (so the access_request test's
beforeAll could not remove the last member of a groupOfNames). Revert it to
'app_super_admin' and recognize 'god_admin' separately in isSuperAdmin + isAdmin.

Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
2026-08-04 16:31:00 -04:00
parent 6d9c2f05ba
commit f00d311029
2 changed files with 10 additions and 4 deletions
+1 -1
View File
@@ -95,7 +95,7 @@ router.get('/me', async function(req, res, next){
// legacy app_sso_admin/app_super_admin during migration.
user.isAdmin = groups.some((g) =>
g === 'app_sso_admin' || g === 'app_super_admin' ||
g === permission.SUPER_ADMIN_GROUP ||
g === 'god_admin' || g === permission.SUPER_ADMIN_GROUP ||
g.endsWith('_super_admin') || g.endsWith('_app_sso_admin'));
return res.json(user);