zio/kintex
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(auth): grant global ADMIN hall-manager scope to resolve 403 on event-scoped APIs

Browse Source 
KintexPrincipal.hasAccess/roleFor ignored global role_code=ADMIN, so
admin@ users got 403 on all event-scoped endpoints. Add isAdmin() and
treat ADMIN as hall-manager equivalent (all-event read + approve).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
zio 2026-07-13 00:15:25 +09:00
parent c77cba7c5b
commit f3b800f9be
1 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/backend/src/main/java/com/zioinfo/kintex/auth/KintexPrincipal.java
View File

@ -37,15 +37,20 @@ public record KintexPrincipal(
this(userId, displayName, eventRoles, hallManager, null, DEFAULT_TENANT);
}
/** 해당 행사에서 사용자의 역할(없으면 null). 홀매니저는 항상 HALL_MANAGER로 간주. */
/** 전역 시스템관리자(app_user.role_code='ADMIN') 여부 — 전 행사 열람+승인(홀매니저 상위). */
public boolean isAdmin() {
return "ADMIN".equalsIgnoreCase(roleCode);
}
/** 해당 행사에서 사용자의 역할(없으면 null). 홀매니저·ADMIN은 항상 HALL_MANAGER로 간주. */
public EventRole roleFor(String eventId) {
if (hallManager) {
if (hallManager || isAdmin()) {
return EventRole.HALL_MANAGER;
}
return eventRoles == null ? null : eventRoles.get(eventId);
}
public boolean hasAccess(String eventId) {
return hallManager || (eventRoles != null && eventRoles.containsKey(eventId));
return hallManager || isAdmin() || (eventRoles != null && eventRoles.containsKey(eventId));
}
}