multipleof4/ntfy
1
0
Fork 0
mirror of https://github.com/multipleof4/ntfy.git synced 2026-10-15 16:07:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1795 from lmorchard/fix/sync-topic-deny-all

Browse Source 
Grant users access to their own sync topic under deny-all (fixes #733)
This commit is contained in:
Philipp C. Heckel
2026-06-22 21:17:37 -04:00
committed by GitHub
parent 7b37f2a3eb cac3b2986a
commit 3bfb9f334b
2 changed files with 14 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
user/manager_test.go
+7
View File
@@ -130,6 +130,13 @@ func TestManager_FullScenario_Default_DenyAll(t *testing.T) {
require.Nil(t, a.Authorize(ben, "announcements", PermissionRead))
require.Equal(t, ErrUnauthorized, a.Authorize(ben, "announcements", PermissionWrite))
// User has full access to their own sync topic, even under deny-all,
// but not to another user's sync topic (#733)
require.Nil(t, a.Authorize(ben, ben.SyncTopic, PermissionRead))
require.Nil(t, a.Authorize(ben, ben.SyncTopic, PermissionWrite))
require.Equal(t, ErrUnauthorized, a.Authorize(ben, john.SyncTopic, PermissionRead))
require.Equal(t, ErrUnauthorized, a.Authorize(ben, john.SyncTopic, PermissionWrite))
// User john should have
// "deny" to mytopic_deny*,
// "ro" to mytopic_ro*,