fix(admin): authorize cross-user ListServiceAccount with ListServiceAccount (#2640)

2026-07-26 16:28:15 +00:00 · 2026-04-22 20:16:09 +08:00
parent f08b592c6f
commit fa1554be7f
1 changed files with 3 additions and 1 deletions
@@ -925,11 +925,13 @@ impl Operation for ListServiceAccount {
        };

        let target_account = if query.user.as_ref().is_some_and(|v| v != &cred.access_key) {
+            // Cross-user listing must be authorized by ListServiceAccounts, matching the
+            // sibling InfoServiceAccount/InfoAccessKey/ListAccessKeysBulk handlers.
            if !iam_store
                .is_allowed(&Args {
                    account: &cred.access_key,
                    groups: &cred.groups,
-                    action: Action::AdminAction(AdminAction::UpdateServiceAccountAdminAction),
+                    action: Action::AdminAction(AdminAction::ListServiceAccountsAdminAction),
                    bucket: "",
                    conditions: &get_condition_values(
                        &req.headers,