mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-09-10 10:35:51 +00:00
rcourtman
7d066f1d5c
On the OIDC-only pattern there is no local admin, so SSO principals are the only administrators the instance has. ensureAdminSession already knows that: sessionUserCarriesAdminPrivileges admits the configured admin, anyone holding an RBAC admin grant, and any SSO principal when no local admin is configured. Three guards did not use it. They compared the session username against cfg.AuthUser directly, which on those instances is empty, so they could admit nobody at all. The same operator was admitted by the settings routes and refused by discovery, by public URL capture, and by config export and import, which is three answers to one question. Verified against an unlicensed OIDC-only router before and after. Before, sessionUserCarriesAdminPrivileges returned true for the SSO owner while canCapturePublicURL and discovery isAdminRequest returned false and /api/config/export returned 403. After, all four agree. This does not widen anything. On an instance that does configure a local admin, an unrelated SSO principal is still not an administrator and every one of these guards still refuses them, which the parity test pins in both directions. RequirePlatformAdmin is deliberately left alone. Its stricter session rule is documented as intentional for the hosted control plane rather than an oversight, and loosening it is a different decision from this one. Contract-Neutral: behavioral fix on existing routes, no request or response shape change; three guards switched to the canonical session-admin helper they should already have used