Skip to content

Commit

Permalink
src/auth: Change admin roles lookup
Browse files Browse the repository at this point in the history
In keycloak admin access is granted through team-support role - which is compose of view-supporters, view-contact-requests.
  • Loading branch information
sashko9807 committed Nov 12, 2023
1 parent e113148 commit 7b6ad68
Showing 1 changed file with 6 additions and 1 deletion.
7 changes: 6 additions & 1 deletion apps/api/src/auth/auth.service.ts
Original file line number Diff line number Diff line change
Expand Up @@ -356,7 +356,12 @@ export class AuthService {
await this.authenticateAdmin()
// check if user is admin before attempting to activate/deactivate
const userGroups = await this.admin.users.listRoleMappings({ id: keycloakId })
const isAdmin = userGroups.realmMappings?.some((obj) => obj.name === 'podkrepi-admin')
const isAdmin = userGroups.realmMappings?.some(
(obj) =>
obj.name === 'team-support' ||
obj.name === 'view-supporters' ||
obj.name === 'view-contact-requests',
)
if (isAdmin) {
throw new ForbiddenException("Admin profiles can't be deactivated")
}
Expand Down

0 comments on commit 7b6ad68

Please sign in to comment.