devsam/core2026
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(gateway): Profile 포괄 운영 권한 제거

Browse Source
This commit is contained in:
Hide_D
2026-08-17 16:07:46 +00:00
parent c2fccb58ab
commit b49332f5b9
16 changed files with 220 additions and 108 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/game-api/src/router/turnDaemon/index.ts
+3 -3
View File
@@ -18,9 +18,9 @@ const turnDaemonAdminProcedure = authedProcedure.use(({ ctx, next }) => {
roles.includes('superuser') ||
roles.includes('admin') ||
roles.includes('admin.superuser') ||
roles.includes('admin.profiles.manage') ||
roles.includes('admin.profiles.manage:*') ||
roles.includes(`admin.profiles.manage:${profileName}`);
roles.includes('admin.profiles.runtime') ||
roles.includes('admin.profiles.runtime:*') ||
roles.includes(`admin.profiles.runtime:${profileName}`);
if (!canManageProfile) {
throw new TRPCError({
code: 'FORBIDDEN',
app/game-api/test/router.test.ts
+20
View File
@@ -803,6 +803,26 @@ describe('appRouter', () => {
});
});
it('accepts the scoped profile runtime permission for turn daemon control', async () => {
const auth = buildAuth();
auth.user.roles = ['admin.profiles.runtime:che:default'];
const caller = appRouter.createCaller(buildContext({ auth }));
await expect(caller.turnDaemon.run({ reason: 'manual' })).resolves.toMatchObject({ accepted: true });
await expect(caller.turnDaemon.pause()).resolves.toMatchObject({ accepted: true });
await expect(caller.turnDaemon.resume()).resolves.toMatchObject({ accepted: true });
await expect(caller.turnDaemon.status()).resolves.toBeDefined();
});
it('rejects the removed umbrella profile permission for turn daemon control', async () => {
const auth = buildAuth();
auth.user.roles = ['admin.profiles.manage:che:default'];
const caller = appRouter.createCaller(buildContext({ auth }));
await expect(caller.turnDaemon.run({ reason: 'manual' })).rejects.toMatchObject({ code: 'FORBIDDEN' });
await expect(caller.turnDaemon.status()).rejects.toMatchObject({ code: 'FORBIDDEN' });
});
it('rejects unauthenticated turn daemon control', async () => {
const caller = appRouter.createCaller(buildContext({ auth: null }));