86c45875a4
Replace the deny-based restriction on granting OWNER with role-scoped allow policies so authorization fails closed: admins may create and update memberships only when the assigned role is not OWNER, and the absence of a target role no longer implies permission. To keep console UI gating accurate without loosening the base grants, the permission field gains an optional typed options argument (PermissionOptionsInput) that forwards target_role into the dry-run authorization. Only the two role-related console calls (create user, update membership) pass it; the OWNER option stays hidden for admins via the existing assignable-roles helper. Add a non-regression test that an admin cannot promote a member to OWNER while still being able to change members between non-owner roles.
49 lines
1.1 KiB
GraphQL
49 lines
1.1 KiB
GraphQL
directive @goField(
|
|
forceResolver: Boolean
|
|
name: String
|
|
omittable: Boolean
|
|
) on INPUT_FIELD_DEFINITION | FIELD_DEFINITION
|
|
|
|
directive @goModel(
|
|
model: String
|
|
models: [String!]
|
|
) on OBJECT | INPUT_OBJECT | SCALAR | ENUM | INTERFACE | UNION
|
|
|
|
directive @goEnum(value: String) on ENUM_VALUE
|
|
|
|
scalar BigInt
|
|
scalar CursorKey
|
|
scalar Datetime
|
|
scalar Upload
|
|
scalar EmailAddr
|
|
scalar OAuth2Scope
|
|
scalar Map
|
|
|
|
interface Node {
|
|
id: ID!
|
|
}
|
|
|
|
type Query {
|
|
node(id: ID!): Node @authentication(required: PRESENT)
|
|
viewer: Identity @authentication(required: PRESENT)
|
|
ssoLoginURL(email: EmailAddr!): String
|
|
@goField(forceResolver: true)
|
|
@authentication(required: OPTIONAL)
|
|
oidcProviders: [OIDCProviderInfo!]!
|
|
@goField(forceResolver: true)
|
|
@authentication(required: OPTIONAL)
|
|
signUpEnabled: Boolean!
|
|
@goField(forceResolver: true)
|
|
@authentication(required: OPTIONAL)
|
|
oauth2ScopesSupported: [OAuth2Scope!]!
|
|
@goField(forceResolver: true)
|
|
@authentication(required: OPTIONAL)
|
|
}
|
|
|
|
type OIDCProviderInfo {
|
|
name: String!
|
|
loginURL: String!
|
|
}
|
|
|
|
type Mutation
|