Admin/media-intelligence-deploy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Sync Media Intelligence role isolation fix

Browse Source
This commit is contained in:
Admin 2026-09-29 19:10:57 +00:00
parent 7cf1c0123a
commit 338f6c232a
1 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/auth.ts
View File

@ -99,9 +99,12 @@ export function mediaRoleFromClaims(claims: Record<string, any>): MediaRole {
if (roles.includes("media-intelligence-editor")) return "editor"; if (roles.includes("media-intelligence-editor")) return "editor";
if (roles.includes("media-intelligence-viewer")) return "viewer"; if (roles.includes("media-intelligence-viewer")) return "viewer";
if (roles.some((role) => /(^|[-_])(owner|admin)$/.test(role))) return "admin"; const arrowstackRoles = roles.filter((role) =>
if (roles.some((role) => /(^|[-_])(operator|developer)$/.test(role))) return "editor"; role.startsWith("arrowstack-") || role.startsWith("arrowstack_")
if (roles.some((role) => /(^|[-_])viewer$/.test(role))) return "viewer"; );
if (arrowstackRoles.some((role) => /(owner|admin)$/.test(role))) return "admin";
if (arrowstackRoles.some((role) => /(operator|developer)$/.test(role))) return "editor";
if (arrowstackRoles.some((role) => /viewer$/.test(role))) return "viewer";
// Fail safe: authenticated users with no recognised mapping can read but not mutate. // Fail safe: authenticated users with no recognised mapping can read but not mutate.
return "viewer"; return "viewer";