gsadmin/pulse
1
0
Fork 0
mirror of https://github.com/rcourtman/Pulse.git synced 2026-10-23 20:25:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

Isolate administration guide session-revocation proof

Browse Source 
Initialise the real persistent auth stores for the guide lifecycle and prove user removal revokes its session and CSRF token. Clarify that an empty role list clears built-in assignments too; no runtime authority changes.

Contract-Neutral: Documentation and test-fixture correction only; session revocation, role assignment and authorization runtime contracts are unchanged.
Change-source: pulse-maintainer
This commit is contained in:
pulse-triage[bot]
2026-10-01 08:55:56 +01:00
parent 2c98baabea
commit 0c3cd4fb3a
3 changed files with 19 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/RBAC.md
+1 -1
View File
@@ -155,7 +155,7 @@ curl --disable --fail-with-body --header "@$HOME/.config/pulse/api-header" \
JSON
```
To remove all custom roles from a user, send an empty list:
To clear a user's entire role assignment, including built-in roles, send an empty list:
```bash
curl --disable --fail-with-body --header "@$HOME/.config/pulse/api-header" \
frontend-modern/public/docs/RBAC.md
+1 -1
View File
@@ -155,7 +155,7 @@ curl --disable --fail-with-body --header "@$HOME/.config/pulse/api-header" \
JSON
```
To remove all custom roles from a user, send an empty list:
To clear a user's entire role assignment, including built-in roles, send an empty list:
```bash
curl --disable --fail-with-body --header "@$HOME/.config/pulse/api-header" \
internal/api/admin_docs_test.go
+17 -1
View File
@@ -10,6 +10,7 @@ import (
"regexp"
"strings"
"testing"
"time"
"github.com/rcourtman/pulse-go-rewrite/internal/config"
"github.com/rcourtman/pulse-go-rewrite/internal/models"
@@ -48,7 +49,14 @@ func adminDocBodies(t *testing.T, name, heading string) [][]byte {
}
func TestAdminDocsCustomRoleLifecycle(t *testing.T) {
manager, err := auth.NewFileManager(t.TempDir())
dataPath := t.TempDir()
resetPersistentAuthStoresForTests()
t.Cleanup(resetPersistentAuthStoresForTests)
InitPersistentAuthStores(dataPath)
const fixtureSession = "admin-docs-jane-session-fixture"
GetSessionStore().CreateSession(fixtureSession, time.Hour, "fixture", "127.0.0.1", "jane")
fixtureCSRF := GetCSRFStore().GenerateCSRFToken(fixtureSession)
manager, err := auth.NewFileManager(dataPath)
if err != nil {
t.Fatal(err)
}
@@ -106,6 +114,14 @@ func TestAdminDocsCustomRoleLifecycle(t *testing.T) {
t.Fatalf("assignment did not persist the complete role list: %+v", assignment)
}
}
if step.method == http.MethodDelete && step.path == "/api/admin/users/jane" {
if _, exists := manager.GetUserAssignment("jane"); exists {
t.Fatal("user removal retained the role assignment")
}
if GetSessionStore().GetSession(fixtureSession) != nil || GetCSRFStore().ValidateCSRFToken(fixtureSession, fixtureCSRF) {
t.Fatal("user removal retained the session or its CSRF token")
}
}
}
if _, exists := manager.GetRole("alert-manager"); exists {
t.Fatal("custom role deletion did not persist")