restrict roles, groups, and permissions for invitations
Open
- Dominant language
- Vue
- Stars
- 257
- Forks
- 60
- PR merge metrics
- No merged PRs in 30d
Description
Currently, a user with an Admin role can invite/create a user with a Super Admin role. This should be restricted the same as user updates.
Contributor guide
No contributing guide indexed for this repository
Research direction
Inspect the invitation user-creation path and compare its authorization checks with the existing user-update behavior. Confirm that an Admin cannot invite or create a Super Admin, while permitted invitation roles, groups, and permissions continue to work consistently with updates.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- nodejs
- Domain
- authorization, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100