Repository navigation
fix(rbac): role assignment failing (Keycloak lookup) + drop redundant viewer - #12
Merged
Merged
Conversation
Assigning any non-admin role triggered a Keycloak group lookup (isAdminByGroup) that fails when querying another user's groups, returning 500 "could not verify the user's groups in Keycloak". The check was also redundant: with ResolveRole, config-granted admin (admin_groups) always wins over the stored DB role, so demoting the DB role of a group-admin has no real effect. Drop the Keycloak lookup entirely; keep isProtectedAdmin (bootstrap admins, no Keycloak) to block changing their role. Also remove `viewer` from the Admin → Users role selector: it behaves exactly like `user` today (no admin-panel access), so offering both only confuses. The role constant stays in the backend for a future read-only role.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Assigning any non-admin role in Admin → Users (e.g. making someone editor) failed in production with
500 — "could not verify the user's groups in Keycloak, operation blocked for security".The anti-demotion guard called
isAdminByGroup, which queries another user's groups via the Keycloak Admin API; that lookup errors in prod and the handler turns the error into a hard 500, blocking every role change. It only surfaced now because before RBAC the guard ran only when demoting touser; the RBAC change extended it to every non-admin role.Fix
isAdminByGroupKeycloak lookup fromUpdateRole. It's redundant: withResolveRole, a config-granted admin (admin_groups) always outranks the stored DB role, so changing a group-admin's DB role has no real effect anyway. KeepisProtectedAdmin(bootstrap admins — no Keycloak needed) to block changing their role.isAdminByGroupmethod, theUserGroupsProvidertype, and the unused handler fields; simplify the constructor.viewerfrom the role selector — today it's identical touser(no admin-panel access), so showing both confuses. Theviewerconstant stays in the backend for a future read-only role.Test plan
PUT /admin/users/{email}/rolewitheditor→ 200 (previously 500 in prod); demote touser→ 200; role persisted.go build,go vet,go test ./internal/{handlers,service,models,middleware}green; webnpm run buildcompiles.isProtectedAdminstill blocks changing a bootstrap admin's role (403).Note: not reproducible in the auth-disabled dev stack originally (no Keycloak lookup path), which is why it slipped past — verified the fix by exercising the role update directly.
🤖 Generated with Claude Code