fix(editor): Restrict workflow and credential sharing to their owners (no-changelog) (#7870)

Removing scope permission checks on workflow and credential sharing and
relying only on resource ownership.
Every user can share only the workflows and credentials they created.
This commit is contained in:
Csaba Tuncsik authored and GitHub committed 2023-11-29 16:36:49 +01:00
1 parent 74b4513298
commit 14f53def07
1 file changed
+2 -2
+2 -2
View File
@@ -84,7 +84,7 @@ export const getCredentialPermissions = (user: IUser | null, credential: ICreden
{ name: 'updateConnection', test: [UserRole.ResourceOwner] },
{
name: 'updateSharing',
test: (permissions) => rbacStore.hasScope('credential:share') || !!permissions.isOwner,
test: (permissions) => !!permissions.isOwner,
},
{ name: 'updateNodeAccess', test: [UserRole.ResourceOwner] },
{ name: 'delete', test: [UserRole.ResourceOwner, UserRole.InstanceOwner] },
@@ -109,7 +109,7 @@ export const getWorkflowPermissions = (user: IUser | null, workflow: IWorkflowDb
},
{
name: 'updateSharing',
test: (permissions) => rbacStore.hasScope('workflow:share') || !!permissions.isOwner,
test: (permissions) => !!permissions.isOwner,
},
{
name: 'delete',