Bugfix/disabling allow all in action governance now disables it - #1479
Open
Xeelee33 wants to merge 2 commits into
Open
Bugfix/disabling allow all in action governance now disables it#1479Xeelee33 wants to merge 2 commits into
Xeelee33 wants to merge 2 commits into
Conversation
Make explicit action-type item policies authoritative during governance checks. Previously, a feature-level allow could still permit an action type such as Azure Maps even when an explicit personal_action_type policy existed with allow_all=false and no allowed principals. This updates action-type enforcement so: - feature-level policy grants access only when no explicit item policy exists - explicit item policies must pass once they are present - empty explicit allowlists correctly block the targeted action type
Xeelee33
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Release Notes & Latest Features
Is this visible to end users?
Is this admin-facing (Admin Settings, governance, deployment, config)?
Should this become a Latest Feature card?
Screenshot needed for the card?
Version bump
application/single_app/config.pyVERSIONthird segment bumped, or not needed because this is docs-onlydeployers/version.txtbumped, or not needed becausedeployers/was not changedTesting / validation
git diff --check origin/Development...HEAD -- application/single_app/config.py application/single_app/functions_governance.pypython -m py_compile application/single_app/config.py application/single_app/functions_governance.pypython scripts/check_broken_access_control.py --base-sha origin/Development --head-sha HEAD application/single_app/functions_governance.pypython scripts/check_xss_sinks.py --base-sha origin/Development --head-sha HEAD application/single_app/functions_governance.pyBefore change, a delegation item with Allow All disabled and no one granted still allowed all users and groups to access it.
Policy configured to disable all access to the Personal Action "Azure Maps"
"Azure Maps" action still available in Personal Workspace:
After change in this PR, the same policy disabled Azure Maps action
Documentation
Security checklist
@swagger_route(security=get_auth_security())sanitize_settings_for_user()