diff --git a/imphnen-iam/src/v1/permissions/permissions_guard.rs b/imphnen-iam/src/v1/permissions/permissions_guard.rs index 3a2a00e..c118e70 100644 --- a/imphnen-iam/src/v1/permissions/permissions_guard.rs +++ b/imphnen-iam/src/v1/permissions/permissions_guard.rs @@ -46,8 +46,11 @@ pub async fn permissions_guard( // Check permissions from database let user_permissions: Vec = user.role.permissions.as_ref().unwrap_or(&vec![]).iter().filter_map(|p| p.as_ref().and_then(|pp| pp.name.clone())).collect(); - // If user has Administrator permission, allow all - if user_permissions.contains(&"Administrator".to_string()) { + // If user has Administrator permission, allow all. + // Accept either the permission name or the canonical permission id. + let admin_name = PermissionsEnum::Administrator.to_string(); + let admin_id = PermissionsEnum::Administrator.id(); + if user_permissions.contains(&admin_name) || user_permissions.contains(&admin_id) { return Ok((claims, state)); } diff --git a/imphnen-middleware/src/permissions_middleware/mod.rs b/imphnen-middleware/src/permissions_middleware/mod.rs index d9172d6..c166ccb 100644 --- a/imphnen-middleware/src/permissions_middleware/mod.rs +++ b/imphnen-middleware/src/permissions_middleware/mod.rs @@ -89,10 +89,12 @@ where } }; let user_permissions: Vec = - user.role.permissions.as_ref().unwrap_or(&vec![]).iter().filter_map(|p| p.as_ref().and_then(|pp| pp.name.clone())).collect(); - - // Check if user has Administrator permission - if yes, allow access to everything - let has_administrator_permission = user_permissions.contains(&PermissionsEnum::Administrator.to_string()); + user.role.permissions.as_ref().unwrap_or(&vec![]).iter().filter_map(|p| p.as_ref().and_then(|pp| pp.name.clone())).collect(); + + // Check if user has Administrator permission - accept either the permission name or the well-known id + let admin_name = PermissionsEnum::Administrator.to_string(); + let admin_id = PermissionsEnum::Administrator.id(); + let has_administrator_permission = user_permissions.contains(&admin_name) || user_permissions.contains(&admin_id); let allowed = has_administrator_permission || permissions .iter() .all(|p| user_permissions.contains(&p.to_string()));