80a5892ecd
* fix(external-auth): keep the default-roles guard when an update omits the policy A PUT that omitted unlinkedPolicy hit ValidatePolicyAsync's null-policy early return before the PolicyDefaultRoles guard, so an actor holding only connections:update could clear a stored create-user policy and silently drop its default-role assignments (refs #7977, #7992). The candidate role set is now computed before the early return -- empty when the policy is omitted -- so clearing, adding, or switching a policy all count as changing default roles. The cheap permission check also runs before the registry-backed role comparison, so the common permitted path skips building the registry. Adds integration coverage for the omitted-policy transition in both directions and for clearing a policy that assigns no roles. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test(external-auth): dispose the request message in PutConnectionAsync Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| component | ||
| integration | ||
| performance | ||
| TlsSmoke | ||
| unit | ||
| Directory.Build.props | ||
| Directory.Build.targets | ||