Skip to content

Commit

Permalink
fix(editor): Restrict workflow and credential sharing to their owners…
Browse files Browse the repository at this point in the history
… (no-changelog) (#7870)

Removing scope permission checks on workflow and credential sharing and
relying only on resource ownership.
Every user can share only the workflows and credentials they created.
  • Loading branch information
cstuncsik authored and netroy committed Nov 29, 2023
1 parent b4bc906 commit 9329080
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions packages/editor-ui/src/permissions.ts
Original file line number Diff line number Diff line change
Expand Up @@ -84,7 +84,7 @@ export const getCredentialPermissions = (user: IUser | null, credential: ICreden
{ name: 'updateConnection', test: [UserRole.ResourceOwner] },
{
name: 'updateSharing',
test: (permissions) => rbacStore.hasScope('credential:share') || !!permissions.isOwner,
test: (permissions) => !!permissions.isOwner,
},
{ name: 'updateNodeAccess', test: [UserRole.ResourceOwner] },
{ name: 'delete', test: [UserRole.ResourceOwner, UserRole.InstanceOwner] },
Expand All @@ -109,7 +109,7 @@ export const getWorkflowPermissions = (user: IUser | null, workflow: IWorkflowDb
},
{
name: 'updateSharing',
test: (permissions) => rbacStore.hasScope('workflow:share') || !!permissions.isOwner,
test: (permissions) => !!permissions.isOwner,
},
{
name: 'delete',
Expand Down

0 comments on commit 9329080

Please sign in to comment.