Skip to content

fix: Update is_admin function and update rust #291

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
Open

fix: Update is_admin function and update rust #291

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
bdf70df
ci: add policy to ignore admin lint error
ZohebShaikh Nov 19, 2025
dc9ab8c
ci: update rust
ZohebShaikh Nov 19, 2025
0e9837b
fix: change is_admin from array to function
ZohebShaikh Nov 19, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .devcontainer/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM docker.io/library/rust:1.84.1-bookworm
FROM docker.io/library/rust:1.91.1-bookworm

RUN rustup component add rustfmt clippy

Expand Down
2 changes: 1 addition & 1 deletion bundler/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM docker.io/library/rust:1.84.1-bookworm AS build
FROM docker.io/library/rust:1.91.1-bookworm AS build

ARG DATABASE_URL

Expand Down
8 changes: 6 additions & 2 deletions policy/diamond/policy/admin/admin.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,11 @@ package diamond.policy.admin
import data.diamond.policy.token
import rego.v1

is_admin[subject] := "super_admin" in data.diamond.data.subjects[subject].permissions
default is_admin(_) := false

is_admin(subject) if {
"super_admin" in data.diamond.data.subjects[subject].permissions
}

beamline_admin_for_subject[subject_name] contains beamline if {
some subject_name, subject in data.diamond.data.subjects
Expand All @@ -13,7 +17,7 @@ beamline_admin_for_subject[subject_name] contains beamline if {
some beamline in role_beamlines
}

admin := is_admin[token.claims.fedid] # regal ignore:rule-name-repeats-package
admin := is_admin(token.claims.fedid) # regal ignore:rule-name-repeats-package

beamline_admin := input.beamline in object.get(beamline_admin_for_subject, token.claims.fedid, [])

Expand Down
6 changes: 3 additions & 3 deletions policy/diamond/policy/admin/admin_test.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ diamond_data := {
}

test_is_admin_for_admin if {
admin.is_admin.carol with data.diamond.data as diamond_data
admin.is_admin("carol") with data.diamond.data as diamond_data
}

test_beamline_admin_for_subject_for_beamline_admin if {
Expand All @@ -45,11 +45,11 @@ test_beamlines_admin_for_subject_for_group_admin if {
}

test_is_admin_for_non_admin if {
not admin.is_admin.alice with data.diamond.data as diamond_data
not admin.is_admin("alice") with data.diamond.data as diamond_data
}

test_is_admin_for_beamline_admin_not_admin if {
not admin.is_admin.bob with data.diamond.data as diamond_data
not admin.is_admin("bob") with data.diamond.data as diamond_data
}

test_beamline_admin_for_subject_for_non_beamline_admin if {
Expand Down
2 changes: 1 addition & 1 deletion policy/diamond/policy/proposal/proposal.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ on_proposal(subject, proposal_number) if {
default access_proposal(_, _) := false

# Allow if subject has super_admin permission
access_proposal(subject, proposal_number) if admin.is_admin[subject] # regal ignore:external-reference
access_proposal(subject, proposal_number) if admin.is_admin(subject) # regal ignore:external-reference

# Allow if subject is on proposal
access_proposal(subject, proposal_number) if on_proposal(subject, proposal_number)
Expand Down
2 changes: 1 addition & 1 deletion policy/diamond/policy/session/session.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ on_session(subject, proposal_number, visit_number) if {
default access_session(_, _, _) := false

# Allow if subject has super_admin permission
access_session(subject, proposal_number, visit_number) if admin.is_admin[subject] # regal ignore:external-reference
access_session(subject, proposal_number, visit_number) if admin.is_admin(subject) # regal ignore:external-reference

# Allow if subject is admin for beamline containing session
access_session(subject, proposal_number, visit_number) if {
Expand Down
Loading