ocrvs-7698 / ocrvs-7691 Stops local sys admin from creating national level staff #7996
+301
−26
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…ns from creating national level users
This comment has been minimized.
This comment has been minimized.
euanmillar
changed the title
rikukissa
reviewed
Nov 15, 2024
Comment on lines
+44
to
+46
| if (!getValidRoles({}, 'asc', 'creationDate', token, user.systemRole)) { | ||
| return h.response().code(400) | ||
| } |
There was a problem hiding this comment.
Let's have the access management in gateway where we have some parts of it already
Comment on lines
+23
to
+46
| export const sysAdminAccessMap: Map<string, string[]> = new Map([ | ||
| [ | ||
| 'LOCAL_SYSTEM_ADMIN', | ||
| [ | ||
| 'FIELD_AGENT', | ||
| 'LOCAL_REGISTRAR', | ||
| 'LOCAL_SYSTEM_ADMIN', | ||
| 'PERFORMANCE_MANAGEMENT', | ||
| 'REGISTRATION_AGENT' | ||
| ] | ||
| ], | ||
| [ | ||
| 'NATIONAL_SYSTEM_ADMIN', | ||
| [ | ||
| 'FIELD_AGENT', | ||
| 'LOCAL_REGISTRAR', | ||
| 'LOCAL_SYSTEM_ADMIN', | ||
| 'NATIONAL_REGISTRAR', | ||
| 'NATIONAL_SYSTEM_ADMIN', | ||
| 'PERFORMANCE_MANAGEMENT', | ||
| 'REGISTRATION_AGENT' | ||
| ] | ||
| ] | ||
| ]) |
There was a problem hiding this comment.
This I think can just be a regular object literal, right?
export const ROLE_CAN_MODIFY_ROLE = {
LOCAL_SYSTEM_ADMIN: [
"FIELD_AGENT",
"LOCAL_REGISTRAR",
"LOCAL_SYSTEM_ADMIN",
"PERFORMANCE_MANAGEMENT",
"REGISTRATION_AGENT",
],
NATIONAL_SYSTEM_ADMIN: [
"FIELD_AGENT",
"LOCAL_REGISTRAR",
"LOCAL_SYSTEM_ADMIN",
"NATIONAL_REGISTRAR",
"NATIONAL_SYSTEM_ADMIN",
"PERFORMANCE_MANAGEMENT",
"REGISTRATION_AGENT",
],
};| @@ -57,3 +62,35 @@ export const getUserId = (authHeader: IAuthHeader): string => { | |||
| const tokenPayload = getTokenPayload(authHeader.Authorization.split(' ')[1]) | |||
| return tokenPayload.sub | |||
| } | |||
|
|
|||
| export async function getValidRoles( | |||
There was a problem hiding this comment.
This function I struggle to understand 🤔
| @@ -34,6 +33,7 @@ export default async function getSystemRoles( | |||
| sortOrder = 'asc' | |||
| } = request.payload as IVerifyPayload | |||
| let criteria = {} | |||
| const token = request.headers.authorization | |||
There was a problem hiding this comment.
Let's this function as generic as possible and do the visual filtering of the list per user role in the frontend. This will be removed as part of the user scopes PR, I think.
rikukissa
reviewed
Nov 15, 2024
Comment on lines
+117
to
+119
| export const canDeactivateUser = (id: string, userDetails: UserDetails) => { | ||
| return id !== userDetails.id ? true : false | ||
| } |
There was a problem hiding this comment.
Should we add the same condition to the backend endpoint? Or maybe it's enough just to prevent it from happening in the UI? Guess it's not that big of a deal
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Stop sys admins from de-activating themselves and stop local sys admins. from creating national level users
Also stops sys admins from being able to delete themselves in the UI:
A National Sys Admin will see the correct roles available to them:
A local system admin will not see national level roles available to them:
