ngcp-panel

History

Kirill Solomko 871fbe41e2 TT#129162 tighten user access checks * add additional centralised checks for inactive and read_only users. * use_userdata_from_session=0 now for all auth realms to cause the data re-fetched from the database, to avoid scenarios when a user is set as inactive or read_only and UI keeps using the cached data. the change only affects cookie and JWT subscriber based sessions as in all other cases, the auth data is fetched from the storage regardless. * add is_active=1 flag for the internal 'system' role, as otherwise access would be permanently denied for it. * default 403 error for denied api requests is changed to "Forbidden" instead of "Forbidden path". Change-Id: I1d6d3c765ca8e017e11845c1f5260243a3963c3b (cherry picked from commit `20e77c7b54`)	5 years ago
..
Credential	TT#80305 add JWT authentication for admin users	6 years ago
Store	TT#129162 tighten user access checks	5 years ago

Kirill Solomko 871fbe41e2 TT#129162 tighten user access checks

* add additional centralised checks for inactive and read_only users.
* use_userdata_from_session=0 now for all auth realms to cause the data
  re-fetched from the database, to avoid scenarios when a user is set
  as inactive or read_only and UI keeps using the cached data.
  the change only affects cookie and JWT subscriber based sessions
  as in all other cases, the auth data is fetched from the storage regardless.
* add is_active=1 flag for the internal 'system' role, as otherwise
  access would be permanently denied for it.
* default 403 error for denied api requests is changed to "Forbidden"
  instead of "Forbidden path".

Change-Id: I1d6d3c765ca8e017e11845c1f5260243a3963c3b
(cherry picked from commit 20e77c7b54)

Credential TT#80305 add JWT authentication for admin users 6 years ago

Store TT#129162 tighten user access checks 5 years ago