fix(contact): enforce employee contact edit permissions#10890
Open
ignatremizov wants to merge 1 commit into
Open
fix(contact): enforce employee contact edit permissions#10890ignatremizov wants to merge 1 commit into
ignatremizov wants to merge 1 commit into
Conversation
Enforce contact edit boundaries for regular users on both the UI and transaction middleware so users can maintain their own profile details without being able to change other employees' person records or communication channels. Changes: - Reject regular-user CUD transactions that update another employee Person or channels attached to that employee, including nested TxApplyIf payloads. - Allow regular users to edit their own contact details and non-employee contacts, while Maintainers and Owners continue to manage employee records. - Share contact editability logic in contact resources and use it in person editing, channel editors, and channel presenters so the UI hides or disables blocked actions. - Add middleware tests covering own-person edits, blocked cross-employee person/channel edits, and maintainer bypass behavior. Validation: - git diff --check - rushx svelte-check in plugins/contact-resources - targeted Rush tests for @hcengineering/middleware and @hcengineering/contact-resources - targeted Rush build for @hcengineering/middleware and @hcengineering/contact-resources Behavioral effect: Regular users can update their own profile contact details, but attempts to edit another employee's person record or attached email, phone, or GitHub channels are blocked even if sent directly to the server.
|
Connected to Huly®: UBERF-16480 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
fix(contact): enforce employee contact edit permissions
Summary
Regular users should be able to maintain their own contact details, but they should not be able to edit another employee's person record or attached communication channels. This change enforces that boundary in both the UI and the server transaction middleware.
Changes
Personor channels attached to that employee.TxApplyIfpayloads so direct transaction bypasses are still blocked.Testing
git diff --check upstream/develop..HEADnode common/scripts/install-run-rush.js test -t @hcengineering/middlewarenode common/scripts/install-run-rush.js build -t @hcengineering/middleware -t @hcengineering/contact-resourcesNotes
rushx svelte-checkinplugins/contact-resourceswas attempted, but this fresh upstream worktree currently fails on broad dependency/export type errors outside this patch.