wmantly
4a592f9795
Closes the end-user half of the directory and adds nested LDAP groups.
The directory could describe the lab but could not tell anyone what they had
or how to reach it, and several of the paths meant to do so were silently
returning nothing:
- GET /api/discovery/me resolved groups from req.user.groups, which does not
exist (req.user carries memberOf), so it returned only isPublic resources
for every human caller -- "My Services" was blank for everyone. The same
read made isDirectoryAdmin() false for real admins.
- The portal's "Discover More Services" called the admin-gated endpoint and
swallowed the 403, so it never rendered for non-admins at all.
- Services reported no address, because /me had reimplemented getMyAccess
without its parent-walking resolution.
Adds the catalog at /, self-service access requests, and admin access
visibility (per-resource counts, and the reverse "what can this user reach").
Nested groups come in two halves. groupOfNames.member already accepts a group
DN, so nesting needs no schema -- what it needs is resolution, which no
released OpenLDAP performs. The all-in-one image therefore builds slapd from a
pinned master commit for the nestgroup overlay, and the app computes the
closure itself when pointed at a server without it. Both paths are covered.
member-values is deliberately left out of nestgroup-flags: it expands `member`
when reading a group, which destroys the distinction between "listed here" and
"reachable through a nested group" and is not recoverable afterwards.
Full suite green in both resolution modes: 215 passed, 2 skipped.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
46 lines
1.5 KiB
JavaScript
46 lines
1.5 KiB
JavaScript
'use strict';
|
|
|
|
const {Group} = require('../models/group_ldap');
|
|
|
|
const SUPER_ADMIN_GROUP = 'app_super_admin';
|
|
|
|
let byGroup = async function(user, groups, ownerOf){
|
|
// Membership is resolved once, transitively: a user placed in an admin group
|
|
// through a nested group is as much a member as one listed on it directly.
|
|
// Checking `group.member.includes(user.dn)` per group -- as this used to --
|
|
// only ever sees the literal member list and would deny them.
|
|
let memberOfCns = [];
|
|
try{
|
|
memberOfCns = await Group.list(user.dn);
|
|
}catch(error){
|
|
// Fall through to the per-group checks below rather than hard-failing;
|
|
// they still catch direct membership if the resolver is unavailable.
|
|
}
|
|
|
|
if(memberOfCns.includes(SUPER_ADMIN_GROUP)) return true;
|
|
|
|
for(let group of groups){
|
|
if(memberOfCns.includes(group)) return true;
|
|
}
|
|
|
|
// `owner` is deliberately NOT transitive. It designates accountable people,
|
|
// and inheriting ownership through a nested group would hand approval rights
|
|
// to anyone transitively in it -- an escalation nobody asked for.
|
|
for(let group of ownerOf || []){
|
|
try{
|
|
group = await Group.get(group);
|
|
if(group.owner.includes(user.dn)) return true
|
|
}catch(error){
|
|
// group not found, continue checking
|
|
}
|
|
}
|
|
|
|
let error = new Error('Insufficient Permission');
|
|
error.name = 'Insufficient Permission';
|
|
error.message = `You do not have permission to perform this action.`;
|
|
error.status = 401;
|
|
throw error;
|
|
}
|
|
|
|
module.exports = {byGroup, SUPER_ADMIN_GROUP};
|