diff --git a/application/single_app/config.py b/application/single_app/config.py index e78cf6160..2d5952068 100644 --- a/application/single_app/config.py +++ b/application/single_app/config.py @@ -98,7 +98,7 @@ EXECUTOR_TYPE = 'thread' EXECUTOR_MAX_WORKERS = 30 SESSION_TYPE = 'filesystem' -VERSION = "0.261.024" +VERSION = "0.261.025" IS_DEVELOPMENT = is_development_env_enabled() # Opt-out for deployments where App Service Easy Auth is active but the platform diff --git a/application/single_app/functions_governance.py b/application/single_app/functions_governance.py index e394cffe8..029885f9c 100644 --- a/application/single_app/functions_governance.py +++ b/application/single_app/functions_governance.py @@ -1228,8 +1228,9 @@ def ensure_action_type_access( ) if _passes_policy(feature_policy, normalized_user_id, user_group_ids): - _set_request_cache_value(decision_key, True) - return + if not action_type_policies: + _set_request_cache_value(decision_key, True) + return if any(_passes_policy(policy, normalized_user_id, user_group_ids) for policy in action_type_policies): _set_request_cache_value(decision_key, True) diff --git a/docs/explanation/release_notes.md b/docs/explanation/release_notes.md index ee28c350f..51bf34fd2 100644 --- a/docs/explanation/release_notes.md +++ b/docs/explanation/release_notes.md @@ -2,6 +2,16 @@ For feature-focused and fix-focused drill-downs by version, see [Features by Version](https://github.com/microsoft/simplechat/tree/main/docs/explanation/features) and [Fixes by Version](https://github.com/microsoft/simplechat/tree/main/docs/explanation/fixes). +### **(v0.261.025)** + +#### Bug Fixes + +* **Delegated Action-Type Policies Now Override Broad Action Access** + * Fixed a governance gap where an explicit delegated item policy for a personal, group, or global action type could still be bypassed by a broader feature-level allow. + * Action-type governance now treats explicit item policies as authoritative once they exist, so a targeted policy such as `personal_action_type = azure_maps` can block that action type even when the broader action feature remains enabled. + * This resolves cases where action types such as Azure Maps continued to appear in action creation flows after admins saved a delegated item policy intended to block them. + * (Ref: delegated item governance, action-type enforcement, `functions_governance.py`) + ### **(v0.261.023)** #### New Features