Repository navigation
fix(auth): renvoyer les rôles admin dérivés des groupes OIDC dans la charge utile de session - #2837
Merged
Merged
Conversation
Co-authored-by: Automata <automata@shikanime.studio> Signed-off-by: William Phetsinorath <william.phetsinorath-open@interieur.gouv.fr> Change-Id: Ib4c3e29a5b12e9029bd271649c324c996a6a6964
|
0 New Issues
0 Fixed Issues
0 Accepted Issues
Open
5 tasks
StephaneTrebel
requested changes
Oct 8, 2026
StephaneTrebel
left a comment
StephaneTrebel
left a comment
Collaborator
There was a problem hiding this comment.
Verdict : changements demandés, uniquement pour l’intégration. Le diff rétablit la liste dédupliquée des rôles OIDC dans le contexte puis la session, sans la persister, et les tests/CI passent sur ce head. La branche est toutefois à 5 commits derrière main ; rebase et nouveaux checks requis avant approbation finale.
StephaneTrebel
self-requested a review
October 8, 2026 11:59
StephaneTrebel
approved these changes
Oct 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pourquoi
Depuis la bascule de
GET /api/v1/authvers server-nestjs (cef4b7c), la charge utile de session ne renvoie plus les rôles admin dérivés des groupes OIDC.AuthController.authretourne la ligne brute de la base —adminRoleIdspersistés seuls — alors que le legacylogViaSessionfusionnait persistés ∪ rôles matchés paroidcGroupdans la réponse, sans jamais persister cette union.Preuve (préviews 2026-10-08, même identité Keycloak, même
session_state) : pile pr-2782 (nestjs) →adminRoleIds: []; pile pr-2816 (legacy) → deux rôles. Le client (stores/user.ts) calculemyAdminRolespuisadminPermsdepuis ce champ : tout le gating d'UI admin tombe pour les administrateurs par groupe OIDC.Quoi
KeycloakJwtService.validatePayloadexpose l'union dédupliquéepersistés ∪ rôles oidc-matchésdans le contexte (maybeAdminContext) — une seule requêtelistMatchingAdminRolesalimente le bitmask et les ids ; les rôles globaux restent exclus de l'union, parité exacte delogViaSession.UserContext/ décorateurAuthUser/ gardesUserGuardetProjectGuardpropagentadminRoleIds.AuthController.authsubstitue l'union aux ids persistés dans la charge utile de session.References
Related: #2835
#2835