RomanNum3ral
/
paperclip
mirror of https://github.com/paperclipai/paperclip.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fix(auth): preserve scoped grants on demotion

This commit is contained in:
cryppadotta 2026-09-10 19:32:56 +00:00
parent 85d8db7ece
commit cc5694449f
2 changed files with 14 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
server/src/__tests__/access-routes-permissions-upgrade.test.ts
View File

@ -144,19 +144,21 @@ describeEmbeddedPostgres("access routes permissions upgrade compatibility", () =
.then((rows) => rows[0]!);
const customScope = { projectIds: ["project-1"] };
await db.insert(principalPermissionGrants).values([
...grantsForHumanRole("admin").map((grant) => ({
companyId: company.id,
principalType: "user" as const,
principalId: member.principalId,
permissionKey: grant.permissionKey,
scope: grant.scope,
grantedByUserId: owner.principalId,
})),
...grantsForHumanRole("admin")
.filter((grant) => grant.permissionKey !== "tools:use")
.map((grant) => ({
companyId: company.id,
principalType: "user" as const,
principalId: member.principalId,
permissionKey: grant.permissionKey,
scope: grant.scope,
grantedByUserId: owner.principalId,
})),
{
companyId: company.id,
principalType: "user" as const,
principalId: member.principalId,
permissionKey: "tasks:assign_scope" as const,
permissionKey: "tools:use" as const,
scope: customScope,
grantedByUserId: owner.principalId,
},
@ -193,7 +195,7 @@ describeEmbeddedPostgres("access routes permissions upgrade compatibility", () =
scope: null,
}),
expect.objectContaining({
permissionKey: "tasks:assign_scope",
permissionKey: "tools:use",
scope: customScope,
grantedByUserId: owner.principalId,
}),

3
server/src/services/access.ts
View File

@ -1,4 +1,4 @@
import { and, eq, inArray, ne, notInArray, sql } from "drizzle-orm";
import { and, eq, inArray, isNull, ne, notInArray, sql } from "drizzle-orm";
import type { Db } from "@paperclipai/db";
import {
companyMemberships,
@ -1137,6 +1137,7 @@ export function accessService(db: Db) {
eq(principalPermissionGrants.principalType, "user"),
eq(principalPermissionGrants.principalId, existing.principalId),
inArray(principalPermissionGrants.permissionKey, retiredDefaultKeys),
isNull(principalPermissionGrants.scope),
));
}
}