86c45875a4
Replace the deny-based restriction on granting OWNER with role-scoped allow policies so authorization fails closed: admins may create and update memberships only when the assigned role is not OWNER, and the absence of a target role no longer implies permission. To keep console UI gating accurate without loosening the base grants, the permission field gains an optional typed options argument (PermissionOptionsInput) that forwards target_role into the dry-run authorization. Only the two role-related console calls (create user, update membership) pass it; the OWNER option stays hidden for admins via the existing assignable-roles helper. Add a non-regression test that an admin cannot promote a member to OWNER while still being able to change members between non-owner roles.
68 lines
1.9 KiB
JSON
68 lines
1.9 KiB
JSON
{
|
|
"root": ".",
|
|
"featureFlags": {
|
|
"enforce_fragment_alias_where_ambiguous": { "kind": "disabled" },
|
|
"enforce_module_name_prefix_for_non_haste": true
|
|
},
|
|
"sources": {
|
|
"apps/console/src/pages/iam": "iam",
|
|
"apps/console/src": "core",
|
|
"apps/trust/src": "trust",
|
|
"apps/compliance-portal/src": "complianceportal"
|
|
},
|
|
"projects": {
|
|
"core": {
|
|
"schema": "pkg/server/api/console/v1/schema.graphql",
|
|
"language": "typescript",
|
|
"noFutureProofEnums": true,
|
|
"output": "apps/console/src/__generated__/core",
|
|
"relativizeJsModulePaths": false,
|
|
"customScalarTypes": {
|
|
"Datetime": "string",
|
|
"GID": "string",
|
|
"CursorKey": "string",
|
|
"Duration": "string",
|
|
"BigInt": "number",
|
|
"EmailAddr": "string"
|
|
}
|
|
},
|
|
"iam": {
|
|
"schema": "pkg/server/api/connect/v1/schema.graphql",
|
|
"language": "typescript",
|
|
"noFutureProofEnums": true,
|
|
"output": "apps/console/src/__generated__/iam",
|
|
"relativizeJsModulePaths": false,
|
|
"customScalarTypes": {
|
|
"Datetime": "string",
|
|
"GID": "string",
|
|
"CursorKey": "string",
|
|
"Duration": "string",
|
|
"BigInt": "number",
|
|
"EmailAddr": "string",
|
|
"OAuth2Scope": "string",
|
|
"Map": "Record<string, string>"
|
|
}
|
|
},
|
|
"trust": {
|
|
"schema": "pkg/server/api/trust/v1/schema.graphql",
|
|
"language": "typescript",
|
|
"noFutureProofEnums": true,
|
|
"customScalarTypes": {
|
|
"Datetime": "string",
|
|
"CursorKey": "string",
|
|
"EmailAddr": "string"
|
|
}
|
|
},
|
|
"complianceportal": {
|
|
"schema": "pkg/server/api/trust/v1/schema.graphql",
|
|
"language": "typescript",
|
|
"noFutureProofEnums": true,
|
|
"customScalarTypes": {
|
|
"Datetime": "string",
|
|
"CursorKey": "string",
|
|
"EmailAddr": "string"
|
|
}
|
|
}
|
|
}
|
|
}
|