diff --git a/app/controllers/general.php b/app/controllers/general.php index 8e63131e65..557da7a254 100644 --- a/app/controllers/general.php +++ b/app/controllers/general.php @@ -245,6 +245,8 @@ App::init(function ($utopia, $request, $response, $console, $project, $consoleDB } } + Authorization::setRole('role:'.$role); + foreach (Auth::getRoles($user) as $authRole) { Authorization::setRole($authRole); } diff --git a/src/Appwrite/Auth/Auth.php b/src/Appwrite/Auth/Auth.php index 7fd402f5bd..4ea9751854 100644 --- a/src/Appwrite/Auth/Auth.php +++ b/src/Appwrite/Auth/Auth.php @@ -3,6 +3,7 @@ namespace Appwrite\Auth; use Appwrite\Database\Document; +use Appwrite\Database\Validator\Authorization; class Auth { @@ -282,11 +283,15 @@ class Auth */ public static function getRoles(Document $user): array { - if ($user->getId()) { - $roles[] = 'user:'.$user->getId(); - $roles[] = 'role:'.Auth::USER_ROLE_MEMBER; - } else { - return ['role:'.Auth::USER_ROLE_GUEST]; + $roles = []; + + if (!self::isPrivilegedUser(Authorization::$roles) && !self::isAppUser(Authorization::$roles)) { + if ($user->getId()) { + $roles[] = 'user:'.$user->getId(); + $roles[] = 'role:'.Auth::USER_ROLE_MEMBER; + } else { + return ['role:'.Auth::USER_ROLE_GUEST]; + } } foreach ($user->getAttribute('memberships', []) as $node) { diff --git a/tests/unit/Auth/AuthTest.php b/tests/unit/Auth/AuthTest.php index de3013f96b..443f244d45 100644 --- a/tests/unit/Auth/AuthTest.php +++ b/tests/unit/Auth/AuthTest.php @@ -4,6 +4,7 @@ namespace Appwrite\Tests; use Appwrite\Auth\Auth; use Appwrite\Database\Document; +use Appwrite\Database\Validator\Authorization; use PHPUnit\Framework\TestCase; class AuthTest extends TestCase @@ -240,4 +241,76 @@ class AuthTest extends TestCase $this->assertContains('team:def', $roles); $this->assertContains('team:def/guest', $roles); } + + public function testPrivilegedUserRoles() + { + Authorization::setRole('role:'.Auth::USER_ROLE_OWNER); + $user = new Document([ + '$id' => '123', + 'memberships' => [ + [ + 'teamId' => 'abc', + 'roles' => [ + 'administrator', + 'moderator' + ] + ], + [ + 'teamId' => 'def', + 'roles' => [ + 'guest' + ] + ] + ] + ]); + + $roles = Auth::getRoles($user); + + $this->assertCount(5, $roles); + $this->assertNotContains('role:member', $roles); + $this->assertNotContains('user:123', $roles); + $this->assertContains('team:abc', $roles); + $this->assertContains('team:abc/administrator', $roles); + $this->assertContains('team:abc/moderator', $roles); + $this->assertContains('team:def', $roles); + $this->assertContains('team:def/guest', $roles); + + Authorization::reset(); + } + + public function testAppUserRoles() + { + Authorization::setRole('role:'.Auth::USER_ROLE_APP); + $user = new Document([ + '$id' => '123', + 'memberships' => [ + [ + 'teamId' => 'abc', + 'roles' => [ + 'administrator', + 'moderator' + ] + ], + [ + 'teamId' => 'def', + 'roles' => [ + 'guest' + ] + ] + ] + ]); + + $roles = Auth::getRoles($user); + + $this->assertCount(5, $roles); + $this->assertNotContains('role:member', $roles); + $this->assertNotContains('user:123', $roles); + $this->assertContains('team:abc', $roles); + $this->assertContains('team:abc/administrator', $roles); + $this->assertContains('team:abc/moderator', $roles); + $this->assertContains('team:def', $roles); + $this->assertContains('team:def/guest', $roles); + + Authorization::reset(); + } }