admins can change external users's names #5965
Conversation
db/schema.rb
Outdated
| @@ -10,7 +10,7 @@ | |||
| # | |||
| # It's strongly recommended that you check this file into your version control system. | |||
|
|
|||
| ActiveRecord::Schema[7.1].define(version: 2023_12_18_154727) do | |||
There was a problem hiding this comment.
This file shouldnt't be included in the changes
| @update_user_params ||= if external_auth? && current_user.role.name.eql?('Administrator') | ||
| params.require(:user).permit(:name) | ||
| elsif external_auth? |
There was a problem hiding this comment.
Greenlight is a bit more tricky than this. The "Administrator" role can be renamed, or the permission to edit users can be given to other roles, meaning that just this check isn't enough. What you need to do instead is check if the user has the ManageUsers permission
There was a problem hiding this comment.
Here's how you would do that:
PermissionsChecker.new(current_user:, permission_names: 'ManageUsers', current_provider:).call
|
Also - did you test to make sure this works? There's a visual portion to this that is needed Rspec tests are needed as well |
This reverts commit bf02581.
signed in doesn't have Manage Users permissions - `external_account` method & attribute moved from current user serializer to user serializer
| @update_user_params ||= if external_auth? && is_admin | ||
| params.require(:user).permit(:name) | ||
| elsif external_auth? | ||
| params.require(:user).permit(:password, :avatar, :language, :role_id, :invite_token) | ||
| else | ||
| params.require(:user).permit(:name, :password, :avatar, :language, :role_id, :invite_token) |
There was a problem hiding this comment.
@update_user_params ||= params.require(:user).permit(permitted_params)
def permitted_params
is_admin = PermissionsChecker.new(current_user:, permission_names: 'ManageUsers', current_provider:).call
return [:password, :avatar, :language, :role_id, :invite_token] if external_auth? && !is_admin
[:name, :password, :avatar, :language, :role_id, :invite_token]
end
|
No description provided.