paultofunmi opened a new pull request, #126: URL: https://github.com/apache/fineract-backoffice-ui/pull/126
AuthService.hasPermission() previously treated ALL_FUNCTIONS_READ as a full superuser bypass, identical to ALL_FUNCTIONS — granting create, update, delete, and approve actions to a permission meant to signal read-only access (e.g. an auditor role). Scope the shortcut so it only satisfies requests made up entirely of READ_* permissions; any request containing a non-READ_* permission now falls through to normal permission-list evaluation. ALL_FUNCTIONS behavior is unchanged. ## Test - Add unit coverage in auth.service.spec.ts - an e2e spec (all-functions-read-shortcut.spec.ts) exercising the real "Create Client" *appHasPermission gate, confirmed to fail against the pre-fix code and pass against the fix. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
