fix: keep SUPER_ADMIN_GROUP as app_super_admin so resource auto-provisioning nesting works
api_directory_admin nests permission.SUPER_ADMIN_GROUP into every new resource's _admin group. Changing it to the not-yet-existing 'god_admin' made that nesting no-op, leaving the creator as the sole member (so the access_request test's beforeAll could not remove the last member of a groupOfNames). Revert it to 'app_super_admin' and recognize 'god_admin' separately in isSuperAdmin + isAdmin. Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
@@ -95,7 +95,7 @@ router.get('/me', async function(req, res, next){
|
||||
// legacy app_sso_admin/app_super_admin during migration.
|
||||
user.isAdmin = groups.some((g) =>
|
||||
g === 'app_sso_admin' || g === 'app_super_admin' ||
|
||||
g === permission.SUPER_ADMIN_GROUP ||
|
||||
g === 'god_admin' || g === permission.SUPER_ADMIN_GROUP ||
|
||||
g.endsWith('_super_admin') || g.endsWith('_app_sso_admin'));
|
||||
|
||||
return res.json(user);
|
||||
|
||||
Reference in New Issue
Block a user