Removing an org member leaves them as owner of resources they created
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 3/5
- 预计耗时
- 1-2 天
- 新手友好度
- 55/100
- Issue 类型
- 缺陷
- 描述清晰度
- 描述清楚
- 活跃度
- 活跃
- 技术栈
- go
- 领域
- authorization, backend
调研方向
Start with cascadeRemovePrincipal in core/membership/org.go, which already deletes the removed member's policies and group relations but not their owner relations on resources. Reproduce with CreateProjectResource, RemoveOrganizationMember, then CheckFederatedResourcePermission for update. Done when a removed member's owner relations are revoked and the update check returns false.
由索引模型根据 Issue 内容生成。
描述
When a member is removed from an organization, Frontier deletes their policies in the org. It does not delete the owner relation on resources they created. A resource's permissions include owner, so the removed member can still update and delete those resources.
This applies to project resources, and to organization resources once #1987 lands.
Steps
- Give an org member a role on a project that lets them create resources, such as
app_project_owner. - The member creates a resource with
CreateProjectResource. - Remove the member with
RemoveOrganizationMember. - Check
updateon the resource for that user withCheckFederatedResourcePermission. It returns true.
Code
cascadeRemovePrincipal in core/membership/org.go deletes the member's policies and group relations, but not their owner relations on resources.
Expected
A removed member has no access to the org's resources.
- 主要语言
- Go
- 星标
- 343
- 派生
- 48
- 平均合并
- 2 天 9 小时
- 30 天内合并 PR
- 48
环境准备
- 提供 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 没有贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
raystack/frontier 的其他 Issue
-
难度 2/5 1-3 小时 新手友好度 72/100
维护者通常 1 天内回复
-
难度 4/5 3-5 天 新手友好度 42/100
维护者通常 1 天内回复
-
难度 4/5 3-5 天 新手友好度 35/100
维护者通常 1 天内回复
-
难度 3/5 1-2 天 新手友好度 62/100
维护者通常 1 天内回复
-
难度 3/5 1-2 天 新手友好度 62/100
维护者通常 1 天内回复
查看 raystack/frontier 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 74/100
QuantumNous/new-api#7839 ·
维护者通常 1 天内回复
-
bug
难度 2/5 1-3 小时 新手友好度 72/100
puppe1990/amarra-cais#355 ·
维护者通常 1 天内回复
-
bug
难度 2/5 1-3 小时 新手友好度 72/100
-
难度 2/5 1-3 小时 新手友好度 72/100
Gentleman-Programming/engram#1899 ·
维护者通常 1 天内回复
-
难度 1/5 1 小时以内 新手友好度 88/100
维护者通常 1 天内回复