Add per-request override for users-unrestricted-roles

Author: ujibang

accounts/src/main/java/org/restheart/accounts/AccountsInitializer.java

@@ -11,6 +11,7 @@
 import org.restheart.plugins.Initializer;
 import org.restheart.plugins.Inject;
 import org.restheart.plugins.RegisterPlugin;
+import org.restheart.accounts.util.RequestOverrides;
 import org.restheart.security.ACLRegistry;
 import org.restheart.security.predicates.BsonRequestWhitelistPredicate;
 import org.slf4j.Logger;
@@ -72,8 +73,10 @@ public void init() {
             if (!(r instanceof MongoRequest mr)) return false;
 
             // Roles configured via `users-unrestricted-roles` (e.g. an admin console
-            // role) bypass this restriction entirely — see AccountsConfigData.
-            var exemptRoles = conf.usersUnrestrictedRoles();
+            // role) bypass this restriction entirely — see AccountsConfigData. Reads
+            // the per-team override first (set by e.g. TeamConfigInterceptor), falling
+            // back to the node-level YAML config.
+            var exemptRoles = RequestOverrides.usersUnrestrictedRoles(mr, conf);
             if (exemptRoles != null && exemptRoles.stream().anyMatch(r::isAccountInRole)) {
                 return false;
             }

accounts/src/main/java/org/restheart/accounts/util/RequestOverrides.java

@@ -4,6 +4,8 @@
 import org.restheart.accounts.oauth.OAuthConfig;
 import org.restheart.exchange.ServiceRequest;
 
+import java.util.List;
+
 /**
  * Reads per-request override parameters and returns the effective values,
  * falling back to the plugin's static configuration.
@@ -66,6 +68,12 @@
  *     <td>Google OAuth client secret for this team</td>
  *     <td>{@code null}</td>
  *   </tr>
+ *   <tr>
+ *     <td>{@code override-accounts-users-unrestricted-roles}</td>
+ *     <td>Roles exempt from the {@code /users} self-service write restriction
+ *         (see {@code AccountsInitializer})</td>
+ *     <td>{@link AccountsConfigData#usersUnrestrictedRoles()}</td>
+ *   </tr>
  * </table>
  *
  * <h2>Multi-team usage (restheart-cloud)</h2>
@@ -139,6 +147,11 @@ public final class RequestOverrides {
     /** Team role for the user who creates a team (override for multi-team). */
     public static final String OWNERSHIP_ROLE = "override-accounts-ownership-role";
 
+    // ── Users self-service write restriction override ───────────────────────
+
+    /** Roles exempt from the {@code /users} self-service write restriction (override for multi-team). */
+    public static final String USERS_UNRESTRICTED_ROLES = "override-accounts-users-unrestricted-roles";
+
     private RequestOverrides() {}
 
     // ── Accessor methods ──────────────────────────────────────────────────────
@@ -201,6 +214,11 @@ public static String ownershipRole(ServiceRequest<?> req, AccountsConfigData con
         return str(req, OWNERSHIP_ROLE, conf.ownershipRole());
     }
 
+    /** Effective roles exempt from the {@code /users} self-service write restriction. */
+    public static List<String> usersUnrestrictedRoles(ServiceRequest<?> req, AccountsConfigData conf) {
+        return list(req, USERS_UNRESTRICTED_ROLES, conf.usersUnrestrictedRoles());
+    }
+
     /**
      * Per-team Google OAuth config, or {@code null} if not overridden.
      * When non-null, this takes precedence over the static {@link OAuthConfig}.
@@ -228,4 +246,13 @@ private static boolean bool(ServiceRequest<?> req, String key, boolean defaultVa
         if (v instanceof String  s) return Boolean.parseBoolean(s);
         return defaultValue;
     }
+
+    @SuppressWarnings("unchecked")
+    private static List<String> list(ServiceRequest<?> req, String key, List<String> defaultValue) {
+        var v = req.attachedParam(key);
+        if (v instanceof List<?> l && !l.isEmpty()) {
+            return (List<String>) l;
+        }
+        return defaultValue;
+    }
 }