YueGuobin ca5db7567c

fix: check both regular ACEs and resource pool ACEs for proper access control ...

This fix addresses a critical issue in the RBAC permission checking logic
introduced in PR #2750. When a project is shared through a resource pool,
both the project creator (with regular ACEs like "All endpoints") and the
shared user (with resource pool ACEs) should be able to see the project.

Changes:
- Modified `check_user_has_privilege` in `gns3server/db/repositories/rbac.py`
- Changed from if-elif (exclusive) to sequential (inclusive) checking
- Now checks regular ACEs first, then resource pool ACEs
- Both types of ACEs can grant access (OR logic instead of XOR)

This fixes the scenario where:
1. user100 has "All endpoints" ACE and creates a project
2. user100 shares the project via resource pool with user200
3. Both users should see the project (user100 via regular ACE, user200 via pool ACE)

Related to PR #2750 - RBAC user isolation implementation.

2026-05-27 00:17:52 +08:00

..

models

feat: add independent LLMConfig permissions for AI profile management

2026-05-26 14:24:41 +08:00

repositories

fix: check both regular ACEs and resource pool ACEs for proper access control

2026-05-27 00:17:52 +08:00

__init__.py

Fix tests.

2020-11-19 15:27:33 +10:30

tasks.py

feat(agent): refactor LLM configuration handling to use centralized config

2026-03-04 13:13:54 +08:00