FlowFuse / FlowFuse/flowfuse

Add admin bypass in `hasPermission` composable to prevent FE lockout

Open
#6,113 0 comments 0 reactions 0 assignees View on GitHub
task
Dominant language
JavaScript
Stars
400
Forks
89
Avg merge
1d 21h
Merged PRs (30d)
146

Description

### Description

**Context / Problem**
Current `hasPermission(scope, teamMembership, context)` can deny admins when application-level roles are lower than team role. This risks locking out admins in the UI. Add an early return that grants all permissions if `teamMembership.role === 'admin'` (or equivalent numeric) or `user.admin === true` (from the account store).

**Acceptance criteria**
- `hasPermission` returns `true` immediately when:
- `teamMembership.role` is admin, or
- `user.admin === true`.
- Bypass applies before any application-level role checks or feature-flag logic.
- Non-admin behavior remains unchanged, including application-scoped role resolution.
- No server-side authorization changes. FE-only safeguard.

### Epic/Story

_No response_

### Have you provided an initial effort estimate for this issue?

I have provided an initial effort estimate

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.