80a5892ecd
* fix(external-auth): keep the default-roles guard when an update omits the policy A PUT that omitted unlinkedPolicy hit ValidatePolicyAsync's null-policy early return before the PolicyDefaultRoles guard, so an actor holding only connections:update could clear a stored create-user policy and silently drop its default-role assignments (refs #7977, #7992). The candidate role set is now computed before the early return -- empty when the policy is omitted -- so clearing, adding, or switching a policy all count as changing default roles. The cheap permission check also runs before the registry-backed role comparison, so the common permitted path skips building the registry. Adds integration coverage for the omitted-policy transition in both directions and for clearing a policy that assigns no roles. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test(external-auth): dispose the request message in PutConnectionAsync Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| Broker | ||
| Compatibility | ||
| Connections | ||
| Distributed | ||
| Fixtures | ||
| Identity | ||
| Links | ||
| Operations | ||
| Permissions | ||
| Persistence | ||
| Scale | ||
| Security | ||
| Sessions | ||
| Elsa.ExternalAuthentication.IntegrationTests.csproj | ||