fix(rbac): fix bug with restart instance

Signed-off-by: Oleksandr Andriienko <[email protected]>
janus-idp · Jul 5, 2024 · cbc15b3 · cbc15b3
1 parent 77edf3a
commit cbc15b3
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 2 deletions.
diff --git a/plugins/rbac-backend/src/audit-log/audit-logger.ts b/plugins/rbac-backend/src/audit-log/audit-logger.ts
@@ -17,6 +17,7 @@ export const RoleEvents = {
   CREATE_ROLE: 'CreateRole',
   UPDATE_ROLE: 'UpdateRole',
   DELETE_ROLE: 'DeleteRole',
+  CREATE_OR_UPDATE_ROLE: 'CreateOrUpdateRole',
   GET_ROLE: 'GetRole',
 
   CREATE_ROLE_ERROR: 'CreateRoleError',

diff --git a/plugins/rbac-backend/src/service/permission-policy.ts b/plugins/rbac-backend/src/service/permission-policy.ts
@@ -73,12 +73,17 @@ const useAdminsFromConfig = async (
   knex: Knex,
 ) => {
   const addedGroupPolicies = new Map<string, string>();
+  const newGroupPolicies = new Map<string, string>();
 
   for (const admin of admins) {
     const entityRef = admin.getString('name');
     validateEntityReference(entityRef);
 
     addedGroupPolicies.set(entityRef, ADMIN_ROLE_NAME);
+
+    if (!(await enf.hasGroupingPolicy(...[entityRef, ADMIN_ROLE_NAME]))) {
+      newGroupPolicies.set(entityRef, ADMIN_ROLE_NAME);
+    }
   }
 
   const adminRoleMeta =
@@ -102,13 +107,13 @@ const useAdminsFromConfig = async (
     throw error;
   }
 
-  const addedRoleMembers = Array.from<string[]>(addedGroupPolicies.entries());
+  const addedRoleMembers = Array.from<string[]>(newGroupPolicies.entries());
   await enf.addGroupingPolicies(addedRoleMembers, getAdminRoleMetadata());
 
   await auditLogger.auditLog<RoleAuditInfo>({
     actorId: RBAC_BACKEND,
     message: `Created or updated role`,
-    eventName: RoleEvents.CREATE_ROLE,
+    eventName: RoleEvents.CREATE_OR_UPDATE_ROLE,
     metadata: {
       ...getAdminRoleMetadata(),
       members: addedRoleMembers.map(gp => gp[0]),