fix(permission): tool manager must not inherit manage_tool_owner (IKABS3) - #2355
Open
yaojin3616 wants to merge 1 commit into
Open
fix(permission): tool manager must not inherit manage_tool_owner (IKABS3)#2355yaojin3616 wants to merge 1 commit into
yaojin3616 wants to merge 1 commit into
Conversation
…BS3) The tool permission template's `default_permission_ids_for_relation` used a generic level-based calculation that handed a manager the `manage_tool_owner` permission (same can_manage level as `manage_tool_manager`). The authorization service then accepted a manager's revoke of an owner-tier grant, and the permission dialog's "manage" dropdown surfaced the owner row's delete action, so a manager could remove an owner's permission on a tool. Switch the tool template to an explicit per-tier default (mirroring channel_permission_template) so a manager only inherits `manage_tool_manager` and `manage_tool_viewer`. The owner tier still receives all three `manage_tool_*` permissions, and the underlying `_can_grant_model` check is unchanged. Update the related default test and add a regression test that pins both the manager's permission set and the authorize-side guard. Refs: gitee IKABS3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
根因
default_permission_ids_for_relation采用「按关系等级累加」的通用算法，所有can_manage级权限的等级相同，导致「管理者」也会被默认授予manage_tool_owner。ResourceAuthorizationService._can_grant_model在manage_tool_owner已在调用方权限集时允许owner关系的 grant/revoke。修复
tool_permission_template.py：将default_permission_ids_for_relation改为显式分层表（与channel_permission_template保持一致），「管理者」只继承manage_tool_manager与manage_tool_viewer，不再包含manage_tool_owner；「所有者」仍然拥有全部三项manage_tool_*。_can_grant_model校验逻辑保持不变。验证
test/permission/test_permission_relation_defaults.py::test_tool_permission_defaults_accept_computed_relations调整断言，新增对「管理者不含manage_tool_owner」「所有者仍含全部 manage_*」的回归断言。test/permission/test_resource_authorization_service.py新增test_manager_cannot_revoke_tool_owner_grant，钉死「管理者」的默认权限集与_can_grant_model('tool', 'owner', owner_model, manager_perm)行为，确保后续回归可被 CI 捕获。default_permission_ids_for_relation('manager')验证：返回{edit_tool, manage_tool_manager, manage_tool_viewer, use_tool, view_tool}，不再含manage_tool_owner。影响范围
application_permission_template（workflow/assistant）与knowledge_library_permission_template，属于同类隐患但不在本工单范围内，后续单独跟进。manage_tool_owner，本次代码修复不会回收其既有权限（绑定数据未变），仅阻断新写入。关联