Skip to content

Commit 1e42316

Browse files
committed
feat(apps): stop an app install depending on the person who registered it
An install-context token resolved its author through the active-user lookup, so disabling the developer who registered an app took the app down with them — the exact thing an organization does when that person leaves. The install now acts as itself: the author is resolved even when disabled or deleted, carries no server role, and neither the token's validity nor its SSO account is checked any more. Per-language grants no longer fall back to the author either — an install has none, and its granted scopes are the whole ceiling. An acted-as user is unchanged: their status and permissions still decide what the app may do. Permission computation tolerates an inactive account rather than failing, so the endpoints that still resolve the author's stored project permissions keep working after they leave.
1 parent 9313529 commit 1e42316

12 files changed

Lines changed: 475 additions & 39 deletions

File tree

backend/api/src/main/kotlin/io/tolgee/api/v2/controllers/keys/KeyTrashController.kt

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,7 @@ class KeyTrashController(
7878
val data =
7979
keyTrashService.getTrashedKeysWithTranslations(
8080
projectId = projectHolder.project.id,
81-
userId = authenticationFacade.authenticatedUser.id,
81+
userId = authenticationFacade.actingPersonUserId,
8282
pageable = pageable,
8383
params = params,
8484
)
@@ -99,7 +99,7 @@ class KeyTrashController(
9999
languageService.getLanguagesForTranslationsView(
100100
params.languages,
101101
projectHolder.project.id,
102-
authenticationFacade.authenticatedUser.id,
102+
authenticationFacade.actingPersonUserId,
103103
)
104104
return SelectAllResponse(
105105
translationService.getSelectAllKeys(

backend/api/src/main/kotlin/io/tolgee/api/v2/controllers/keys/SelectAllController.kt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ class SelectAllController(
6767
languageService.getLanguagesForTranslationsView(
6868
params.languages,
6969
projectHolder.project.id,
70-
authenticationFacade.authenticatedUser.id,
70+
authenticationFacade.actingPersonUserId,
7171
)
7272

7373
return SelectAllResponse(

backend/api/src/main/kotlin/io/tolgee/api/v2/controllers/translation/TranslationsController.kt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -258,7 +258,7 @@ When null, resulting file will be a flat key-value object.
258258
languageService.getLanguagesForTranslationsView(
259259
params.languages,
260260
projectHolder.project.id,
261-
authenticationFacade.authenticatedUser.id,
261+
authenticationFacade.actingPersonUserId,
262262
)
263263

264264
val pageableWithSort = getSafeSortPageable(pageable)

0 commit comments

Comments
 (0)