Skip to content

refactor(authorization): pass IUser to permission checks where already loaded #41346

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ggazzo merged 4 commits into from
Jul 20, 2026
Merged

refactor(authorization): pass IUser to permission checks where already loaded #41346

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
1ae92c6
refactor(authorization): pass IUser to permission checks where alread…
ggazzo Jul 13, 2026
faf86e0
fix(authorization): keep user-id form where the loaded user lacks roles
ggazzo Jul 14, 2026
02fb2de
fix(authorization): don't pass full/rolesless user objects to permiss…
ggazzo Jul 15, 2026
7679521
Merge branch 'develop' into chore/authz-pass-iuser-migration
ggazzo Jul 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions apps/meteor/ee/server/lib/audit/methods.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,7 +92,7 @@ Meteor.methods<ServerMethods>({
check(endDate, Date);

const user = (await Meteor.userAsync()) as IUser;
if (!user || !(await hasPermissionAsync(user._id, 'can-audit'))) {
if (!user || !(await hasPermissionAsync(user, 'can-audit'))) {
throw new Meteor.Error('Not allowed');
}

Expand Down Expand Up @@ -139,7 +139,7 @@ Meteor.methods<ServerMethods>({
check(endDate, Date);

const user = (await Meteor.userAsync()) as IUser;
if (!user || !(await hasPermissionAsync(user._id, 'can-audit'))) {
if (!user || !(await hasPermissionAsync(user, 'can-audit'))) {
throw new Meteor.Error('Not allowed');
}

Expand Down
2 changes: 1 addition & 1 deletion apps/meteor/server/api/webhooks.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -169,7 +169,7 @@ async function executeIntegrationRest(
return API.v1.unavailable('Service Unavailable');
}

if (!(await hasPermissionAsync(this.user._id, 'message-impersonate'))) {
if (!(await hasPermissionAsync(this.user, 'message-impersonate'))) {
incomingLogger.error({
msg: 'Error trying to execute integration',
integration: this.request.integration.name,
Expand Down
2 changes: 1 addition & 1 deletion apps/meteor/server/lib/omnichannel/closeLivechatRoom.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ export const closeLivechatRoom = async (
}

const subscription = await Subscriptions.findOneByRoomIdAndUserId(roomId, user._id, { projection: { _id: 1 } });
if (!subscription && !(await hasPermissionAsync(user._id, 'close-others-livechat-room'))) {
if (!subscription && !(await hasPermissionAsync(user, 'close-others-livechat-room'))) {
throw new Error('error-not-authorized');
}

Expand Down
2 changes: 1 addition & 1 deletion apps/meteor/server/lib/omnichannel/startup.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,7 +87,7 @@ Meteor.startup(async () => {
callbacks.add(
'beforeJoinRoom',
async (user, room) => {
if (isOmnichannelRoom(room) && !(await hasPermissionAsync(user._id, 'view-l-room'))) {
if (isOmnichannelRoom(room) && !(await hasPermissionAsync(user, 'view-l-room'))) {
throw new Meteor.Error('error-user-is-not-agent', 'User is not an Omnichannel Agent', {
method: 'beforeJoinRoom',
});
Expand Down
4 changes: 2 additions & 2 deletions apps/meteor/server/meteor-methods/rooms/createPrivateGroup.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,10 +43,10 @@ export const createPrivateGroupMethod = async (
method: 'createPrivateGroup',
});
}
if (!(await hasPermissionAsync(user._id, 'create-team-group', team.roomId))) {
if (!(await hasPermissionAsync(user, 'create-team-group', team.roomId))) {
throw new Meteor.Error('error-not-allowed', 'Not allowed', { method: 'createPrivateGroup' });
}
} else if (!(await hasPermissionAsync(user._id, 'create-p'))) {
} else if (!(await hasPermissionAsync(user, 'create-p'))) {
throw new Meteor.Error('error-not-allowed', 'Not allowed', { method: 'createPrivateGroup' });
}

Expand Down
4 changes: 2 additions & 2 deletions apps/meteor/server/meteor-methods/rooms/leaveRoom.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,8 +29,8 @@ export const leaveRoomMethod = async (user: IUser, rid: string): Promise<void> =
}

if (
(room.t === 'c' && !(await hasPermissionAsync(user._id, 'leave-c'))) ||
(room.t === 'p' && !(await hasPermissionAsync(user._id, 'leave-p')))
(room.t === 'c' && !(await hasPermissionAsync(user, 'leave-c'))) ||
(room.t === 'p' && !(await hasPermissionAsync(user, 'leave-p')))
) {
throw new Meteor.Error('error-not-allowed', 'Not allowed', { method: 'leaveRoom' });
}
Expand Down
2 changes: 1 addition & 1 deletion ee/packages/federation-matrix/src/FederationMatrix.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -941,7 +941,7 @@ export class FederationMatrix extends ServiceClass implements IFederationMatrixS
}

async canUserAccessFederation(user: IUser): Promise<boolean> {
if (!(await Authorization.hasPermission(user._id, 'access-federation'))) {
if (!(await Authorization.hasPermission({ _id: user._id, roles: user.roles }, 'access-federation'))) {
Comment thread
ggazzo marked this conversation as resolved.
return false;
}

Expand Down
Loading