Sacha Al Himdani 2ffeb7f3e8
Require set-owner authorization to create OWNER membership ...
An organization ADMIN could mint an OWNER membership via createUser, which
only gated iam:membership-profile:create and bypassed the owner-only
iam:membership-role:set-owner check that updateMembership already enforces.
Gate the requested role in both createUser entry points (connect resolver
and the MCP CreateUserTool) with an additional set-owner authorization when
the role is OWNER, mirroring updateMembership. Add a regression test that
locks the ADMIN/OWNER privilege boundary the fix relies on.
Signed-off-by: Sacha Al Himdani <sacha@probo.com >
2026-07-03 17:37:26 +02:00
2026-06-30 14:11:09 +02:00
2026-07-02 18:05:43 +02:00
2026-06-23 18:24:50 +02:00
2026-06-09 16:45:23 +02:00
2026-06-09 16:45:23 +02:00
2026-06-22 19:23:41 +02:00
2026-07-01 11:47:43 +02:00
2026-06-12 17:24:00 +02:00
2026-06-19 17:13:39 +02:00
2026-06-09 16:45:23 +02:00
2026-06-23 19:17:56 +02:00
2026-07-02 18:25:41 +02:00
2026-06-24 22:22:51 +02:00
2026-07-03 10:12:59 +02:00
2026-07-03 10:11:50 +02:00
2026-06-09 16:45:23 +02:00
2026-06-09 16:45:23 +02:00
2026-06-09 16:45:23 +02:00
2026-06-15 19:18:42 +02:00
2026-06-09 16:45:23 +02:00
2026-07-02 18:45:51 +02:00
2026-06-09 16:45:23 +02:00
2026-06-09 16:45:23 +02:00
2026-07-03 10:11:47 +02:00
2026-06-09 16:45:23 +02:00
2026-07-03 10:12:59 +02:00
2026-07-02 18:58:06 +02:00
2026-06-09 16:45:23 +02:00
2026-06-09 16:45:23 +02:00
2026-06-16 14:35:16 +02:00
2026-06-30 18:36:47 +02:00
2026-06-16 14:35:16 +02:00
2026-06-09 16:45:23 +02:00
2026-07-03 11:53:57 +02:00
2026-06-23 19:36:34 +02:00
2026-06-30 14:10:41 +02:00
2026-07-01 11:47:43 +02:00
2026-06-11 13:46:10 +02:00
2026-06-23 18:24:50 +02:00
2026-06-09 16:45:23 +02:00
2026-06-16 14:35:16 +02:00
2026-06-09 16:45:23 +02:00
2026-06-09 16:45:23 +02:00
2026-06-09 16:45:23 +02:00
2026-07-03 17:37:26 +02:00
2026-06-29 14:40:24 +02:00
2026-06-09 16:45:23 +02:00
2026-06-09 16:45:23 +02:00
2026-06-12 14:39:53 +02:00
2026-06-12 14:39:53 +02:00
2026-07-03 10:13:00 +02:00
2026-06-10 17:49:40 +02:00
2026-06-09 16:45:23 +02:00
2026-06-09 16:45:23 +02:00
2026-06-30 14:44:07 +02:00
2026-07-01 17:13:59 +02:00
2026-06-12 14:39:51 +02:00
2ffeb7f3e8