Skip to content

Don't use user.manage permission for packet management permission checks#258

Open
david-mears-2 wants to merge 2 commits intomrc-6905-show-installed-packagesfrom
mrc-6623-split-permissions
Open

Don't use user.manage permission for packet management permission checks#258
david-mears-2 wants to merge 2 commits intomrc-6905-show-installed-packagesfrom
mrc-6623-split-permissions

Conversation

@david-mears-2
Copy link
Copy Markdown
Contributor

canManageAllPackets is the name of functions that existed both in the front end and the back end, which allow users to manage packets when they have global user.manage permission (including when they don't have packet.manage).

We should keep packet management permissions separate from user management, so I have removed this function and replaced it with a reference to hasGlobalPacketManagePermission.

The exception to keeping the two scopes separate is when granting users packet-related permissions; that really is both user management and packet management. It looks like currently these actions are defended only by 'user.manage' (e.g. at the top of RoleController), i.e. through packit I can give someone (myself excluded) permissions for any packet, regardless of whether I have permissions for that packet. This seems OK but I wanted to check.

@david-mears-2 david-mears-2 force-pushed the mrc-6623-split-permissions branch from 30f3afe to b2ec4f3 Compare March 10, 2026 17:10
@codecov
Copy link
Copy Markdown

codecov bot commented Mar 10, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.26%. Comparing base (01427e2) to head (09979aa).

Additional details and impacted files
@@                         Coverage Diff                          @@
##           mrc-6905-show-installed-packages     #258      +/-   ##
====================================================================
- Coverage                             99.26%   99.26%   -0.01%     
====================================================================
  Files                                   203      203              
  Lines                                  5889     5887       -2     
  Branches                                983      981       -2     
====================================================================
- Hits                                   5846     5844       -2     
  Misses                                   42       42              
  Partials                                  1        1              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Copy link
Copy Markdown
Contributor

@absternator absternator left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The initial idea was to make user.manage kind of like a god permission. As people who can manage users can pretty much do anything in the application. Thus not having to add packet.manage or any other permissions to people who can manage users. As this probably the highest level permission.

The issue here is if they want to add permissions to a user with packets but dont have the manage permission then they cant add those permissions. Beacuse pretty sure they wont see the list of packets and packet groups anymore when updating permissions. This is not right: a user with user.manage should be able to add/remove any permission to a user without needing packet.manage. See screenshot below with a new user with only user. manage

Image

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants