rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Enforce owner-only member removal and ownership grants via policy

Browse Source 
An organization ADMIN could hard-remove members, including OWNERs, because
removeUser (connect and MCP) only checked the weaker iam:membership-profile:delete
gate. Authorize the owner-only iam:membership:delete instead, and expose the
source attribute on MembershipProfile so the owner grant's non-SCIM condition
can match.

Consolidate ownership-grant authorization into policy for both createUser and
updateMembership: each resolver passes the requested role as a target_role
attribute and ADMIN is denied granting ownership via deny-create-owner /
deny-promote-owner. target_role is distinct from resource.role, which is the
target's current role and guards editing existing owners. With no callers left,
the iam:membership-role:set-owner action (grant and OAuth2 scope) is removed.

Also pass the authorized scope through to the RemoveUser/CreateUser services,
gate the console Remove action on iam:membership:delete, and add regression
tests plus a changelog entry.

Signed-off-by: Sacha Al Himdani <sacha@probo.com>
This commit is contained in:
Sacha Al Himdani
2026-07-06 16:21:51 +02:00
parent ddfabc5940
commit ff9cb881e8
13 changed files with 133 additions and 62 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
apps/console/src/pages/iam/organizations/people/PersonPage.tsx
View File

@@ -36,6 +36,7 @@ export const personPageQuery = graphql`
source
state
canDelete: permission(action: "iam:membership-profile:delete")
canRemoveMember: permission(action: "iam:membership:delete")
...PersonFormFragment
}
}
@@ -140,7 +141,7 @@ export function PersonPage(props: { queryRef: PreloadedQuery<PersonPageQuery> })
};
const canArchive = person.canDelete && person.source !== "SCIM" && person.state !== "INACTIVE";
const canRemove = person.canDelete && person.source !== "SCIM";
const canRemove = person.canRemoveMember && person.source !== "SCIM";
return (
<div className="space-y-6">

3
apps/console/src/pages/iam/organizations/people/_components/PeopleListItem.tsx
View File

@@ -65,6 +65,7 @@ const fragment = graphql`
canUpdate: permission(action: "iam:membership-profile:update")
canInvite: permission(action: "iam:invitation:create")
canDelete: permission(action: "iam:membership-profile:delete")
canRemoveMember: permission(action: "iam:membership:delete")
}
`;
@@ -137,7 +138,7 @@ export function PeopleListItem(props: {
const canSendActivationMail = isInactive && profile.source !== "SCIM" && profile.canInvite;
const canArchive = profile.canDelete && profile.source !== "SCIM" && profile.state !== "INACTIVE";
const canRemove = profile.canDelete && profile.source !== "SCIM";
const canRemove = profile.canRemoveMember && profile.source !== "SCIM";
const [inviteUser]
= useMutationWithToasts<PeopleListItem_inviteMutation>(inviteUserMutation, {