From b27e4a4404228ecd472c44afd1c9db1825ebe956 Mon Sep 17 00:00:00 2001 From: MythEclipse Date: Sun, 5 Oct 2025 19:39:15 +0700 Subject: [PATCH] refactor: Enhance permission checks to accept both name and ID for Administrator role --- imphnen-iam/src/v1/permissions/permissions_guard.rs | 7 +++++-- imphnen-middleware/src/permissions_middleware/mod.rs | 10 ++++++---- 2 files changed, 11 insertions(+), 6 deletions(-) diff --git a/imphnen-iam/src/v1/permissions/permissions_guard.rs b/imphnen-iam/src/v1/permissions/permissions_guard.rs index 3a2a00e..c118e70 100644 --- a/imphnen-iam/src/v1/permissions/permissions_guard.rs +++ b/imphnen-iam/src/v1/permissions/permissions_guard.rs @@ -46,8 +46,11 @@ pub async fn permissions_guard( // Check permissions from database let user_permissions: Vec = user.role.permissions.as_ref().unwrap_or(&vec![]).iter().filter_map(|p| p.as_ref().and_then(|pp| pp.name.clone())).collect(); - // If user has Administrator permission, allow all - if user_permissions.contains(&"Administrator".to_string()) { + // If user has Administrator permission, allow all. + // Accept either the permission name or the canonical permission id. + let admin_name = PermissionsEnum::Administrator.to_string(); + let admin_id = PermissionsEnum::Administrator.id(); + if user_permissions.contains(&admin_name) || user_permissions.contains(&admin_id) { return Ok((claims, state)); } diff --git a/imphnen-middleware/src/permissions_middleware/mod.rs b/imphnen-middleware/src/permissions_middleware/mod.rs index d9172d6..c166ccb 100644 --- a/imphnen-middleware/src/permissions_middleware/mod.rs +++ b/imphnen-middleware/src/permissions_middleware/mod.rs @@ -89,10 +89,12 @@ where } }; let user_permissions: Vec = - user.role.permissions.as_ref().unwrap_or(&vec![]).iter().filter_map(|p| p.as_ref().and_then(|pp| pp.name.clone())).collect(); - - // Check if user has Administrator permission - if yes, allow access to everything - let has_administrator_permission = user_permissions.contains(&PermissionsEnum::Administrator.to_string()); + user.role.permissions.as_ref().unwrap_or(&vec![]).iter().filter_map(|p| p.as_ref().and_then(|pp| pp.name.clone())).collect(); + + // Check if user has Administrator permission - accept either the permission name or the well-known id + let admin_name = PermissionsEnum::Administrator.to_string(); + let admin_id = PermissionsEnum::Administrator.id(); + let has_administrator_permission = user_permissions.contains(&admin_name) || user_permissions.contains(&admin_id); let allowed = has_administrator_permission || permissions .iter() .all(|p| user_permissions.contains(&p.to_string()));