Manage User should not read roles

onaio · Nov 21, 2024 · 391f90b · 391f90b
1 parent c04863a
commit 391f90b
Showing 1 changed file with 1 addition and 4 deletions.
diff --git a/packages/rbac/src/adapters/keycloakAdapter.ts b/packages/rbac/src/adapters/keycloakAdapter.ts
@@ -44,10 +44,7 @@ export const parseFHirRoles = (role: string) => {
 const keycloakRoleMappings: Record<string, UserRole> = {
   'realm-admin': new UserRole(['iam_group', 'iam_role', 'iam_user'], Permit.MANAGE),
   'view-users': new UserRole(['iam_user'], Permit.READ),
-  'manage-users': UserRole.combineRoles([
-    new UserRole(['iam_user'], Permit.MANAGE),
-    new UserRole(['iam_role', 'iam_group'], Permit.READ),
-  ]),
+  'manage-users': UserRole.combineRoles([new UserRole(['iam_user'], Permit.MANAGE)]),
   'query-groups': new UserRole(['iam_group'], Permit.READ),
   'view-groups': new UserRole(['iam_group'], Permit.READ),
   'query-users': new UserRole(['iam_user'], Permit.READ),