Skip to content

Commit 4988032

Browse files
pnmcostapnmcosta
committed
prevent child account user from being restricted
1 parent a404bb1 commit 4988032

File tree

6 files changed

+51
-39
lines changed

6 files changed

+51
-39
lines changed

‎management/server/account/manager.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -116,5 +116,5 @@ type Manager interface {
116116
CreateAccountByPrivateDomain(ctx context.Context, initiatorId, domain string) (*types.Account, error)
117117
UpdateToPrimaryAccount(ctx context.Context, accountId string) (*types.Account, error)
118118
GetOwnerInfo(ctx context.Context, accountId string) (*types.UserInfo, error)
119-
GetCurrentUserInfo(ctx context.Context, accountID, userID string) (*users.UserInfoWithPermissions, error)
119+
GetCurrentUserInfo(ctx context.Context, userAuth nbcontext.UserAuth) (*users.UserInfoWithPermissions, error)
120120
}

‎management/server/http/handlers/users/users_handler.go‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -273,15 +273,13 @@ func (h *handler) getCurrentUser(w http.ResponseWriter, r *http.Request) {
273273
return
274274
}
275275

276-
accountID, userID := userAuth.AccountId, userAuth.UserId
277-
278-
user, err := h.accountManager.GetCurrentUserInfo(ctx, accountID, userID)
276+
user, err := h.accountManager.GetCurrentUserInfo(ctx, userAuth)
279277
if err != nil {
280278
util.WriteError(r.Context(), err, w)
281279
return
282280
}
283281

284-
util.WriteJSONObject(r.Context(), w, toUserWithPermissionsResponse(user, userID))
282+
util.WriteJSONObject(r.Context(), w, toUserWithPermissionsResponse(user, userAuth.UserId))
285283
}
286284

287285
func toUserWithPermissionsResponse(user *users.UserInfoWithPermissions, userID string) *api.User {

‎management/server/http/handlers/users/users_handler_test.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -128,8 +128,8 @@ func initUsersTestData() *handler {
128128

129129
return nil
130130
},
131-
GetCurrentUserInfoFunc: func(ctx context.Context, accountID, userID string) (*users.UserInfoWithPermissions, error) {
132-
switch userID {
131+
GetCurrentUserInfoFunc: func(ctx context.Context, userAuth nbcontext.UserAuth) (*users.UserInfoWithPermissions, error) {
132+
switch userAuth.UserId {
133133
case "not-found":
134134
return nil, status.NewUserNotFoundError("not-found")
135135
case "not-of-account":
@@ -200,7 +200,7 @@ func initUsersTestData() *handler {
200200
}, nil
201201
}
202202

203-
return nil, fmt.Errorf("user id %s not handled", userID)
203+
return nil, fmt.Errorf("user id %s not handled", userAuth.UserId)
204204
},
205205
},
206206
}

‎management/server/mock_server/account_mock.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -116,7 +116,7 @@ type MockAccountManager struct {
116116
CreateAccountByPrivateDomainFunc func(ctx context.Context, initiatorId, domain string) (*types.Account, error)
117117
UpdateToPrimaryAccountFunc func(ctx context.Context, accountId string) (*types.Account, error)
118118
GetOwnerInfoFunc func(ctx context.Context, accountID string) (*types.UserInfo, error)
119-
GetCurrentUserInfoFunc func(ctx context.Context, accountID, userID string) (*users.UserInfoWithPermissions, error)
119+
GetCurrentUserInfoFunc func(ctx context.Context, userAuth nbcontext.UserAuth) (*users.UserInfoWithPermissions, error)
120120
GetAccountMetaFunc func(ctx context.Context, accountID, userID string) (*types.AccountMeta, error)
121121
}
122122

@@ -883,9 +883,9 @@ func (am *MockAccountManager) GetOwnerInfo(ctx context.Context, accountId string
883883
return nil, status.Errorf(codes.Unimplemented, "method GetOwnerInfo is not implemented")
884884
}
885885

886-
func (am *MockAccountManager) GetCurrentUserInfo(ctx context.Context, accountID, userID string) (*users.UserInfoWithPermissions, error) {
886+
func (am *MockAccountManager) GetCurrentUserInfo(ctx context.Context, userAuth nbcontext.UserAuth) (*users.UserInfoWithPermissions, error) {
887887
if am.GetCurrentUserInfoFunc != nil {
888-
return am.GetCurrentUserInfoFunc(ctx, accountID, userID)
888+
return am.GetCurrentUserInfoFunc(ctx, userAuth)
889889
}
890890
return nil, status.Errorf(codes.Unimplemented, "method GetCurrentUserInfo is not implemented")
891891
}

‎management/server/user.go‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ import (
1212

1313
"github.com/netbirdio/netbird/management/server/activity"
1414
nbContext "github.com/netbirdio/netbird/management/server/context"
15+
nbcontext "github.com/netbirdio/netbird/management/server/context"
1516
"github.com/netbirdio/netbird/management/server/idp"
1617
nbpeer "github.com/netbirdio/netbird/management/server/peer"
1718
"github.com/netbirdio/netbird/management/server/permissions/modules"
@@ -1217,7 +1218,9 @@ func validateUserInvite(invite *types.UserInfo) error {
12171218
}
12181219

12191220
// GetCurrentUserInfo retrieves the account's current user info and permissions
1220-
func (am *DefaultAccountManager) GetCurrentUserInfo(ctx context.Context, accountID, userID string) (*users.UserInfoWithPermissions, error) {
1221+
func (am *DefaultAccountManager) GetCurrentUserInfo(ctx context.Context, userAuth nbcontext.UserAuth) (*users.UserInfoWithPermissions, error) {
1222+
accountID, userID := userAuth.AccountId, userAuth.UserId
1223+
12211224
user, err := am.Store.GetUserByUserID(ctx, store.LockingStrengthShare, userID)
12221225
if err != nil {
12231226
return nil, err
@@ -1247,7 +1250,7 @@ func (am *DefaultAccountManager) GetCurrentUserInfo(ctx context.Context, account
12471250

12481251
userWithPermissions := &users.UserInfoWithPermissions{
12491252
UserInfo: userInfo,
1250-
Restricted: user.IsRestrictable() && settings.RegularUsersViewBlocked,
1253+
Restricted: !userAuth.IsChild && user.IsRestrictable() && settings.RegularUsersViewBlocked,
12511254
}
12521255

12531256
permissions, err := am.permissionsManager.GetPermissionsByRole(ctx, user.Role)

‎management/server/user_test.go‎

Lines changed: 37 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -1573,39 +1573,33 @@ func TestDefaultAccountManager_GetCurrentUserInfo(t *testing.T) {
15731573

15741574
tt := []struct {
15751575
name string
1576-
accountId string
1577-
userId string
1576+
userAuth nbcontext.UserAuth
15781577
expectedErr error
15791578
expectedResult *users.UserInfoWithPermissions
15801579
}{
15811580
{
15821581
name: "not found",
1583-
accountId: account1.Id,
1584-
userId: "not-found",
1582+
userAuth: nbcontext.UserAuth{AccountId: account1.Id, UserId: "not-found"},
15851583
expectedErr: status.NewUserNotFoundError("not-found"),
15861584
},
15871585
{
15881586
name: "not part of account",
1589-
accountId: account1.Id,
1590-
userId: "account2Owner",
1587+
userAuth: nbcontext.UserAuth{AccountId: account1.Id, UserId: "account2Owner"},
15911588
expectedErr: status.NewUserNotPartOfAccountError(),
15921589
},
15931590
{
15941591
name: "blocked",
1595-
accountId: account1.Id,
1596-
userId: "blocked-user",
1592+
userAuth: nbcontext.UserAuth{AccountId: account1.Id, UserId: "blocked-user"},
15971593
expectedErr: status.NewUserBlockedError(),
15981594
},
15991595
{
16001596
name: "service user",
1601-
accountId: account1.Id,
1602-
userId: "service-user",
1597+
userAuth: nbcontext.UserAuth{AccountId: account1.Id, UserId: "service-user"},
16031598
expectedErr: status.NewPermissionDeniedError(),
16041599
},
16051600
{
1606-
name: "owner user",
1607-
accountId: account1.Id,
1608-
userId: "account1Owner",
1601+
name: "owner user",
1602+
userAuth: nbcontext.UserAuth{AccountId: account1.Id, UserId: "account1Owner"},
16091603
expectedResult: &users.UserInfoWithPermissions{
16101604
UserInfo: &types.UserInfo{
16111605
ID: "account1Owner",
@@ -1624,9 +1618,8 @@ func TestDefaultAccountManager_GetCurrentUserInfo(t *testing.T) {
16241618
},
16251619
},
16261620
{
1627-
name: "regular user",
1628-
accountId: account1.Id,
1629-
userId: "regular-user",
1621+
name: "regular user",
1622+
userAuth: nbcontext.UserAuth{AccountId: account1.Id, UserId: "regular-user"},
16301623
expectedResult: &users.UserInfoWithPermissions{
16311624
UserInfo: &types.UserInfo{
16321625
ID: "regular-user",
@@ -1644,9 +1637,8 @@ func TestDefaultAccountManager_GetCurrentUserInfo(t *testing.T) {
16441637
},
16451638
},
16461639
{
1647-
name: "admin user",
1648-
accountId: account1.Id,
1649-
userId: "admin-user",
1640+
name: "admin user",
1641+
userAuth: nbcontext.UserAuth{AccountId: account1.Id, UserId: "admin-user"},
16501642
expectedResult: &users.UserInfoWithPermissions{
16511643
UserInfo: &types.UserInfo{
16521644
ID: "admin-user",
@@ -1664,9 +1656,8 @@ func TestDefaultAccountManager_GetCurrentUserInfo(t *testing.T) {
16641656
},
16651657
},
16661658
{
1667-
name: "settings blocked regular user",
1668-
accountId: account2.Id,
1669-
userId: "settings-blocked-user",
1659+
name: "settings blocked regular user",
1660+
userAuth: nbcontext.UserAuth{AccountId: account2.Id, UserId: "settings-blocked-user"},
16701661
expectedResult: &users.UserInfoWithPermissions{
16711662
UserInfo: &types.UserInfo{
16721663
ID: "settings-blocked-user",
@@ -1684,10 +1675,30 @@ func TestDefaultAccountManager_GetCurrentUserInfo(t *testing.T) {
16841675
Restricted: true,
16851676
},
16861677
},
1678+
1679+
{
1680+
name: "settings blocked regular user child account",
1681+
userAuth: nbcontext.UserAuth{AccountId: account2.Id, UserId: "settings-blocked-user", IsChild: true},
1682+
expectedResult: &users.UserInfoWithPermissions{
1683+
UserInfo: &types.UserInfo{
1684+
ID: "settings-blocked-user",
1685+
Name: "",
1686+
Role: "user",
1687+
Status: "active",
1688+
IsServiceUser: false,
1689+
IsBlocked: false,
1690+
NonDeletable: false,
1691+
LastLogin: time.Time{},
1692+
Issued: "api",
1693+
IntegrationReference: integration_reference.IntegrationReference{},
1694+
},
1695+
Permissions: mergeRolePermissions(roles.User),
1696+
Restricted: false,
1697+
},
1698+
},
16871699
{
1688-
name: "settings blocked owner user",
1689-
accountId: account2.Id,
1690-
userId: "account2Owner",
1700+
name: "settings blocked owner user",
1701+
userAuth: nbcontext.UserAuth{AccountId: account2.Id, UserId: "account2Owner"},
16911702
expectedResult: &users.UserInfoWithPermissions{
16921703
UserInfo: &types.UserInfo{
16931704
ID: "account2Owner",
@@ -1709,7 +1720,7 @@ func TestDefaultAccountManager_GetCurrentUserInfo(t *testing.T) {
17091720

17101721
for _, tc := range tt {
17111722
t.Run(tc.name, func(t *testing.T) {
1712-
result, err := am.GetCurrentUserInfo(context.Background(), tc.accountId, tc.userId)
1723+
result, err := am.GetCurrentUserInfo(context.Background(), tc.userAuth)
17131724

17141725
if tc.expectedErr != nil {
17151726
assert.Equal(t, err, tc.expectedErr)

0 commit comments

Comments
 (0)