Skip to content

fix(verify): restrict verify tool access to approve_tree and super_pe… - #1230

Open
yasiru98 wants to merge 1 commit into
Greenstand:masterfrom
yasiru98:fix/818-verify-tool-permission-policy
Open

fix(verify): restrict verify tool access to approve_tree and super_pe…#1230
yasiru98 wants to merge 1 commit into
Greenstand:masterfrom
yasiru98:fix/818-verify-tool-permission-policy

Conversation

@yasiru98

Copy link
Copy Markdown

Description

  • Fixes an issue where users with only the list_tree policy could access the Verify tool.
  • In AppContext.js, the hasPermission check for the Verify route included POLICIES.LIST_TREE alongside POLICIES.SUPER_PERMISSION and POLICIES.APPROVE_TREE. Since hasPermission returns true if the user has at least one of the listed policies, list_tree alone was sufficient to gain access.
  • Removed POLICIES.LIST_TREE from the Verify route permission check so only users with approve_tree or super_permission can access the tool.

Issue(s) addressed

What kind of change(s) does this PR introduce?

  • Bug fix

Please check if the PR fulfils these requirements

  • The commit message follows our guidelines
  • Tests for the changes have been added (for bug fixes / features)
  • Docs have been added / updated (for bug fixes / features)

Issue

What is the current behavior?

Users with only the list_tree policy can access the Verify tool. The Verify tool should be restricted to users with approve_tree or super_permission policies only.

What is the new behavior?

Only users with approve_tree or super_permission policies can access the Verify tool. Users with only list_tree are shown the Unauthorized page.

Breaking change

Does this PR introduce a breaking change?

No.

Other useful information

@yasiru98
yasiru98 requested a review from a team as a code owner July 13, 2026 22:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Only allow access to Verify tool for users with approve_tree or super_permission policies

1 participant