gsadmin/AutopilotMonitor
1
0
Fork 0
mirror of https://github.com/okieselbach/AutopilotMonitor.git synced 2026-10-24 04:32:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

fixed galactic admin check in signalrgroup join/leave

Browse Source
This commit is contained in:
Oliver Kieselbach
2026-02-07 21:34:56 +01:00
parent 7fae27f0da
commit ef2190c687
2 changed files with 50 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/Backend/AutopilotMonitor.Functions/Functions/SignalRAddToGroupFunction.cs
+25 -3
View File
@@ -53,11 +53,33 @@ namespace AutopilotMonitor.Functions.Functions
var userEmail = TenantHelper.GetUserIdentifier(req);
// Validate tenant access
// Group names are in format: "tenant-{tenantId}" or "session-{tenantId}-{sessionId}"
// Group names are in format: "tenant-{tenantId}", "session-{tenantId}-{sessionId}", or "galactic-admins"
// Users can only join groups for their own tenant (unless they are Galactic Admin)
var requestedTenantId = ExtractTenantIdFromGroupName(request.GroupName);
if (!string.IsNullOrEmpty(requestedTenantId))
// Explicit validation for the galactic-admins group
if (request.GroupName == "galactic-admins")
{
var isGalacticAdmin = await _galacticAdminService.IsGalacticAdminAsync(userEmail);
if (!isGalacticAdmin)
{
_logger.LogWarning($"User {userEmail} (tenant {userTenantId}) attempted to join galactic-admins group without being a Galactic Admin");
var forbiddenResponse = req.CreateResponse(HttpStatusCode.Forbidden);
await forbiddenResponse.WriteAsJsonAsync(new { success = false, message = "Access denied: Only Galactic Admins can join this group" });
return new AddToGroupOutput { HttpResponse = forbiddenResponse };
}
_logger.LogInformation($"Galactic Admin {userEmail} joining galactic-admins group");
}
else
{
var requestedTenantId = ExtractTenantIdFromGroupName(request.GroupName);
if (string.IsNullOrEmpty(requestedTenantId))
{
_logger.LogWarning($"User {userEmail} attempted to join unrecognized group format: {request.GroupName}");
var badRequestResponse = req.CreateResponse(HttpStatusCode.BadRequest);
await badRequestResponse.WriteAsJsonAsync(new { success = false, message = "Unrecognized group name format" });
return new AddToGroupOutput { HttpResponse = badRequestResponse };
}
// Check if user is allowed to join this tenant's group
if (requestedTenantId != userTenantId)
{
src/Backend/AutopilotMonitor.Functions/Functions/SignalRRemoveFromGroupFunction.cs
+25 -3
View File
@@ -53,11 +53,33 @@ namespace AutopilotMonitor.Functions.Functions
var userEmail = TenantHelper.GetUserIdentifier(req);
// Validate tenant access (same logic as AddToGroup)
// Group names are in format: "tenant-{tenantId}" or "session-{tenantId}-{sessionId}"
// Group names are in format: "tenant-{tenantId}", "session-{tenantId}-{sessionId}", or "galactic-admins"
// Users can only leave groups for their own tenant (unless they are Galactic Admin)
var requestedTenantId = ExtractTenantIdFromGroupName(request.GroupName);
if (!string.IsNullOrEmpty(requestedTenantId))
// Explicit validation for the galactic-admins group
if (request.GroupName == "galactic-admins")
{
var isGalacticAdmin = await _galacticAdminService.IsGalacticAdminAsync(userEmail);
if (!isGalacticAdmin)
{
_logger.LogWarning($"User {userEmail} (tenant {userTenantId}) attempted to leave galactic-admins group without being a Galactic Admin");
var forbiddenResponse = req.CreateResponse(HttpStatusCode.Forbidden);
await forbiddenResponse.WriteAsJsonAsync(new { success = false, message = "Access denied: Only Galactic Admins can leave this group" });
return new RemoveFromGroupOutput { HttpResponse = forbiddenResponse };
}
_logger.LogInformation($"Galactic Admin {userEmail} leaving galactic-admins group");
}
else
{
var requestedTenantId = ExtractTenantIdFromGroupName(request.GroupName);
if (string.IsNullOrEmpty(requestedTenantId))
{
_logger.LogWarning($"User {userEmail} attempted to leave unrecognized group format: {request.GroupName}");
var badRequestResponse = req.CreateResponse(HttpStatusCode.BadRequest);
await badRequestResponse.WriteAsJsonAsync(new { success = false, message = "Unrecognized group name format" });
return new RemoveFromGroupOutput { HttpResponse = badRequestResponse };
}
// Check if user is allowed to leave this tenant's group
if (requestedTenantId != userTenantId)
{