fix(orgs): improve org administration (#16747)#16755
Conversation
JeremyCloarec
changed the title
|
🤖 [AI-generated] Hey @JeremyCloarec! 👋 Thanks a lot for opening PR #16755 — really appreciate the contribution to org administration! 🙏 I just had a quick look and I think the description could be enhanced a little to help reviewers get through it faster. I haven't touched your description at all — just a gentle, optional suggestion:
No rush at all — thanks again for contributing to OpenCTI! 🚀 |
There was a problem hiding this comment.
Pull request overview
This PR tightens organization administration permissions in the opencti-graphql backend by preventing “organization admin only” users (VIRTUAL_ORGANIZATION_ADMIN without SETTINGS_SET_ACCESSES) from modifying an organization’s grantable_groups via the generic STIX Domain Object field patch path.
Changes:
- Add a guard in
stixDomainObjectEditFieldto reject updates tograntable_groupswhen the caller is only an organization admin. - Introduce and use
isOnlyOrgaAdmin+ForbiddenAccessto enforce the restriction consistently at the domain layer.
| const verifyGrantableGroupInput = (user, input) => { | ||
| const grantableGroupsInput = input.find((e) => e.key === 'grantable_groups'); | ||
| if (!grantableGroupsInput) { | ||
| return; | ||
| } | ||
| if (isOnlyOrgaAdmin(user)) { | ||
| throw ForbiddenAccess(); | ||
| } |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #16755 +/- ##
==========================================
+ Coverage 24.09% 24.13% +0.04%
==========================================
Files 3271 3272 +1
Lines 173270 173500 +230
Branches 42957 43060 +103
==========================================
+ Hits 41744 41879 +135
- Misses 131526 131621 +95
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
| if (!grantableGroupsInput) { | ||
| return; | ||
| } | ||
| if (isOnlyOrgaAdmin(user)) { |
There was a problem hiding this comment.
why not simply check : !isUserHasCapability(user, SETTINGS_SET_ACCESSES) ?
There was a problem hiding this comment.
you're right, that's a better fix 👍
| if (!grantableGroupsInput) { | ||
| return; | ||
| } | ||
| if (isOnlyOrgaAdmin(user)) { |
There was a problem hiding this comment.
| if (isOnlyOrgaAdmin(user)) { | |
| if (!isUserHasCapability(user, SETTINGS_SET_ACCESSES)) { |
Proposed changes
Related issues
How to test this PR
Checklist
Further comments