rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add migration to fix wrong GIDs

Browse Source 
Signed-off-by: Émile Ré <emile@getprobo.com>
This commit is contained in:
Émile Ré
2026-01-19 18:34:11 +04:00
parent 8559a11be5
commit acdbc79a8f
3 changed files with 14 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
pkg/coredata/migrations/20251006T220024Z.sql
View File

@@ -34,7 +34,7 @@ CREATE TABLE authz_invitations (
INSERT INTO authz_memberships (tenant_id, id, user_id, organization_id, role, created_at, updated_at) INSERT INTO authz_memberships (tenant_id, id, user_id, organization_id, role, created_at, updated_at)
SELECT SELECT
organizations.tenant_id, organizations.tenant_id,
generate_gid(decode_base64_unpadded(organizations.tenant_id), 38) as id, generate_gid(decode_base64_unpadded(organizations.tenant_id), 39) as id,
users_organizations.user_id, users_organizations.user_id,
users_organizations.organization_id, users_organizations.organization_id,
'MEMBER'::authz_role as role, -- Default role for existing memberships 'MEMBER'::authz_role as role, -- Default role for existing memberships

9
pkg/coredata/migrations/20260119T182800.sql Normal file
View File

@@ -0,0 +1,9 @@
UPDATE
iam_memberships m
SET
id = generate_gid(decode_base64_unpadded(o.tenant_id), 39)
FROM
organizations o
WHERE
o.id = m.organization_id
AND extract_entity_type(parse_gid(m.id)) = 38;

5
pkg/iam/iam_policies.go
View File

@@ -135,7 +135,10 @@ var IAMOwnerPolicy = policy.NewPolicy(
ActionMembershipDelete, ActionMembershipDelete,
). ).
WithSID("membership-deletion-owner-access"). WithSID("membership-deletion-owner-access").
When(policy.NotEquals("resource.source", "SCIM")), When(
policy.Equals("principal.organization_id", "resource.organization_id"),
policy.NotEquals("resource.source", "SCIM"),
),
// Can set other members OWNER // Can set other members OWNER
policy.Allow(ActionMembershipRoleSetOwner). policy.Allow(ActionMembershipRoleSetOwner).