Repository navigation
fix(roles): let a signed-in user read their own role, and probe each permission level as its user - #632
Merged
Conversation
GET /api/me/role exists so a user can learn their own LaunchPad role (REQ-ROLE-006: "any authenticated user"), but its action was seeded admin-only, so every user it exists for got HTTP 403 and only admins, whose answer is always "admin", could call it. It returns only the caller's own role, so opening it to @ALL widens nothing. Fresh installs take it from the seed. Existing installs get it from baseline revision 2, which applies ONLY what it added: re-applying the whole baseline would re-broaden every action an admin has since set back to admin-only, because such an entry looks exactly like the pristine default.
…ncipal helpers Nothing tested the rules that decide whether one user may change another's dashboard. PermissionServiceLevelsTest pins them at the service: view_only permits nothing but reading, add_only everything but removing a compulsory widget, full that too, metadata follows ownership rather than level, and a stranger is refused whatever the level says. support/principals.ts provisions accounts over basic auth with an explicit header, because password confirmation expires thirty minutes after login and a session-provisioned account starts 403ing purely because the suite ran late.
…ove the probe is that user dashboard-permission-levels.spec.ts shares an admin dashboard with a throwaway account at view_only, add_only and full, and checks every refusal three ways: the exact 403, a re-read as admin proving nothing landed, and a control where the same write succeeds for a principal who may make it. Every account and dashboard it creates is removed in afterAll. principals.ts sends basic credentials on every request and carries no storage state, because Playwright only sends httpCredentials after a 401 and an inherited admin session cookie means that challenge never comes: a view-only probe then runs as the admin. assertActingAs() makes that a failed precondition instead of a permission result. The context gets a 60 s budget since every call authenticates from scratch.
…ntrol-scenario-coverage
…strative action ddbe076 opened admin.get-my-role to @ALL because REQ-ROLE-006 says any authenticated user may read their own role, and getMyRole() only ever answers for the caller. ActionAuthBaselineTest still listed it as admin-only, so the full suite failed on the branch. It now sits in BASELINE_ACTIONS, where reverting the seed to admin-only fails the suite.
rubenvdlinde
requested review from
SudoThijn,
WilcoLouwerse,
bbrands02,
remko48 and
rjzondervan
as code owners
September 14, 2026 09:04
Contributor
Quality Report — ConductionNL/launchpad @
|
| Check | PHP | Vue | Security | License | Tests |
|---|---|---|---|---|---|
| lint | ✅ | ||||
| phpcs | ✅ | ||||
| phpmd | ✅ | ||||
| psalm | ✅ | ||||
| phpstan | ✅ | ||||
| phpmetrics | ✅ | ||||
| eslint | ✅ | ||||
| stylelint | ✅ | ||||
| build | ✅ | ||||
| check-manifest | ✅ | ||||
| format | ✅ | ||||
| check-schema-l10n | ✅ | ||||
| composer | ✅ | ✅ 104/104 | |||
| npm | ✅ | ✅ 534/534 | |||
| app:check-code | ⏭️ | ||||
| info.xml | ✅ | ||||
| REUSE | ❌ | ||||
| PHPUnit | ✅ | ||||
| Newman | ✅ | ||||
| Playwright | ⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it on any branch from the Actions tab, or locally with npx playwright test. |
||||
| Hydra gates | ✅ |
Quality workflow — 2026-09-14 09:12 UTC
Download the full PDF report from the workflow artifacts.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this is
test/access-control-scenario-coveragefrom 09-11, which was pushed but never opened as a PR, plus the work that was still uncommitted in its clone. Development was merged in without conflicts.Fix
GET /api/me/roleexists so any authenticated user can learn their LaunchPad role (REQ-ROLE-006), butadmin.get-my-rolewas seeded admin-only, so every user it exists for got 403. The seed now carries@all, and baseline revision 2 inApplyActionBaselineapplies only that entry to existing installs, so actions an admin has narrowed are not re-broadened.getMyRole()only ever answers for the caller.ActionAuthBaselineTeststill listedadmin.get-my-roleas an administrative action, so the full PHPUnit suite failed on this branch. It now sits with the ordinary user surface; reverting the seed to admin-only failstestShippedSeedCoversTheWholeOrdinaryUserSurface, checked by hand.Tests
PermissionServiceLevelsTestpins whatview_only,add_onlyandfullallow at the service.tests/e2e/dashboard-permission-levels.spec.tsshares an admin dashboard with a throwaway account at each level and checks every refusal three ways: the exact 403, a re-read as admin proving nothing landed, and a control where a principal who may make the write succeeds. Every account and dashboard it creates is removed inafterAll.tests/e2e/support/principals.tssends basic credentials on every request with no storage state, because an inherited admin session cookie means Playwright never sends them and a view-only probe silently runs as admin.assertActingAs()turns that into a failed precondition.Verified locally
diff-check.py(hydra development) with the gate package from ConductionNL/.github main: gates PASS with COVERAGE 36 of 36 applicable gates ran; php -l, phpstan, the touched unit tests and eslint PASS. phpcs reports 25 new findings, all intests/Unit(named parameters);phpcs.xmlscopes the standard tolib, which has none.COMPOSER_PROCESS_TIMEOUT=0 composer check:strict: lint, phpcs, phpmd, psalm and phpstan passed; PHPUnit failed on the baseline test described above. After that fixcomposer test:allexits 0 (1712 tests, 10 skipped).npm run lint: exit 0.Not verified
The Playwright specs were not run. The shared instance on localhost:8080 serves the workspace launchpad checkout, which is on another session's branch, so it would not exercise this code, and the permission spec switches the instance-wide personal dashboards setting on.