Repository navigation
Using super admin to create resource for other tenants and orgs - #1639
Conversation
|
@coderabbitai full review |
✅ Actions performedFull review triggered. |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughAdds configurable HTTP headers and constants for org/tenant admin override, middleware logic to validate and resolve overrides via OrganizationExtensionQueries (updating req.decodedToken), i18n strings, expands notification admin role acceptance, propagates tenant-admin in user roles, and adds a migration to provision tenant-scoped admin permissions. ChangesAdmin Override via Headers
Sequence DiagramsequenceDiagram
participant Client
participant Authenticator
participant OrganizationExtensionQueries
participant DB
Client->>Authenticator: request with override headers
Authenticator->>OrganizationExtensionQueries: findOne(orgCode, tenantCode)
OrganizationExtensionQueries->>DB: SELECT mapping FROM organization_extension
DB-->>OrganizationExtensionQueries: mapping row
OrganizationExtensionQueries-->>Authenticator: mapping result
Authenticator->>Authenticator: validate and set req.decodedToken
Authenticator-->>Client: proceed or failureResponse(400)
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
borkarsaish65
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (2)
src/middlewares/authenticator.js (2)
161-232: 💤 Low valueConsider extracting the override resolution into a helper.
The two branches (
isTenantAdmin && !isAdminandelse if (isAdmin)) duplicate the structure of validate-headers →OrganizationExtensionQueries.findOne→ mutatereq.decodedToken, with only the tenant source and required-headers set differing. A small helper such asresolveAdminOverride(req, { requireTenantHeader, tenantCode })would centralize the mutation ofreq.decodedToken(and the string coercion suggested above), reducing the chance of one branch drifting away from the other on future fixes.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/middlewares/authenticator.js` around lines 161 - 232, Extract the duplicate override logic into a helper (e.g., resolveAdminOverride(req, { requireTenantHeader, tenantCodeSource })) that: reads and trims orgCode and tenantCode from headers using common.ORG_CODE_HEADER / common.TENANT_CODE_HEADER, validates required headers, calls OrganizationExtensionQueries.findOne({ organization_code: orgCode }, tenantCode), and mutates req.decodedToken (organization_id, organization_code, and optionally tenant_code) or throws the existing failureResponses; then replace the two branches (isTenantAdmin && !isAdmin and isAdmin) to call this helper with requireTenantHeader=false/true and tenantCodeSource either req.decodedToken.tenant_code or the header value accordingly.
156-232: ⚡ Quick winAdd audit logging for admin/tenant_admin overrides.
This block silently rewrites the effective
organization_id,organization_code, and (for full admins)tenant_codeon the decoded token, which downstream business logic and DB queries trust as the caller's identity. For an admin override feature, audit-trail logging (callerid, role, sourcetenant_code, targetorg_code/tenant_code, request path, timestamp) is a standard requirement and the only after-the-fact way to investigate misuse. Consider piping this through the existing structured logger so it can be shipped to the observability stack.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/middlewares/authenticator.js` around lines 156 - 232, Add structured audit logging whenever an admin or tenant-admin override changes req.decodedToken (after the validation blocks in the isTenantAdmin and isAdmin branches where req.decodedToken.organization_id/organization_code and req.decodedToken.tenant_code are assigned). Log the caller identifier from req.decodedToken (e.g., sub or user_id), the roles variable, the original source tenant_code (req.decodedToken.tenant_code before change), the target orgCode/tenantCode values (orgCode, tenantCode), the request path (req.path or req.originalUrl), and a timestamp; send this via the existing structured logger (e.g., processLogger or the module used elsewhere) at info/audit level so the event is recorded in the observability stack. Ensure the log is emitted in both the tenant-admin override branch (where only orgCode is set) and the admin branch (where tenantCode+orgCode are set).
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/locales/en.json`:
- Line 191: Update the locale string for key ADD_ORG_OR_TENANT_HEADER to
correctly describe the two headers and remove the awkward comma; replace the
current text with something like: "Please provide the required organization and
tenant headers: {{orgCodeHeader}} and {{tenantCodeHeader}} for admin override."
Ensure you edit the value for ADD_ORG_OR_TENANT_HEADER only and preserve the
interpolation tokens {{orgCodeHeader}} and {{tenantCodeHeader}} exactly.
In `@src/middlewares/authenticator.js`:
- Around line 171-198: The tenant_admin branch currently uses
effectiveTenantCode = req.decodedToken.tenant_code and calls
OrganizationExtensionQueries.findOne without enforcing a tenant scope, allowing
cross-tenant org resolution when tenant_code is missing; fix this by explicitly
validating that req.decodedToken.tenant_code is present and non-empty before
calling OrganizationExtensionQueries.findOne (when isTenantAdmin && !isAdmin),
and if missing throw the same kind of failureResponse (e.g., CLIENT_ERROR /
bad_request) rather than proceeding, so the lookup always happens with a
guaranteed tenant_code and req.decodedToken.organization_id / organization_code
are only set after a tenant-scoped findOne succeeds.
- Around line 171-198: When handling the branch for isTenantAdmin && !isAdmin,
explicitly reject requests that include a caller-provided tenant header instead
of silently ignoring it: check the parsed tenant header variable (the value read
into tenantCode / the x-tenant-code header) and if it is present throw
responses.failureResponse with a clear client error (use
httpStatusCode.bad_request and a distinct message/key such as
'TENANT_CODE_NOT_ALLOWED_FOR_TENANT_ADMIN' or similar), keeping the existing
overrideOrg lookup and assignment to req.decodedToken.organization_id and
organization_code unchanged for cases where no tenant header is provided.
- Around line 197-229: The override path assigns overrideOrg.organization_id
(from OrganizationExtensionQueries.findOne) directly to
req.decodedToken.organization_id which can be a number; coerce it to a string
(like the earlier normalization and the admin-token branch that uses
organizationId.toString()) so downstream string comparisons/caching remain
correct—update both places where overrideOrg.organization_id is assigned to
req.decodedToken.organization_id to convert the value to a string before
assignment.
---
Nitpick comments:
In `@src/middlewares/authenticator.js`:
- Around line 161-232: Extract the duplicate override logic into a helper (e.g.,
resolveAdminOverride(req, { requireTenantHeader, tenantCodeSource })) that:
reads and trims orgCode and tenantCode from headers using common.ORG_CODE_HEADER
/ common.TENANT_CODE_HEADER, validates required headers, calls
OrganizationExtensionQueries.findOne({ organization_code: orgCode },
tenantCode), and mutates req.decodedToken (organization_id, organization_code,
and optionally tenant_code) or throws the existing failureResponses; then
replace the two branches (isTenantAdmin && !isAdmin and isAdmin) to call this
helper with requireTenantHeader=false/true and tenantCodeSource either
req.decodedToken.tenant_code or the header value accordingly.
- Around line 156-232: Add structured audit logging whenever an admin or
tenant-admin override changes req.decodedToken (after the validation blocks in
the isTenantAdmin and isAdmin branches where
req.decodedToken.organization_id/organization_code and
req.decodedToken.tenant_code are assigned). Log the caller identifier from
req.decodedToken (e.g., sub or user_id), the roles variable, the original source
tenant_code (req.decodedToken.tenant_code before change), the target
orgCode/tenantCode values (orgCode, tenantCode), the request path (req.path or
req.originalUrl), and a timestamp; send this via the existing structured logger
(e.g., processLogger or the module used elsewhere) at info/audit level so the
event is recorded in the observability stack. Ensure the log is emitted in both
the tenant-admin override branch (where only orgCode is set) and the admin
branch (where tenantCode+orgCode are set).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: fb1dc4a8-8059-49b4-a553-dabc3cefae88
📒 Files selected for processing (5)
src/.env.samplesrc/constants/common.jssrc/envVariables.jssrc/locales/en.jsonsrc/middlewares/authenticator.js
| "PROFILE_NOT_UPDATED": "Please update your profile with all the mandatory fields", | ||
| "BULK_SESSIONS_REMOVED": "Bulk session removal process successfully executed.", | ||
| "ADD_ORG_HEADER": "{{orgIdHeader}} is mandatory when {{adminHeader}} is passed", | ||
| "ADD_ORG_OR_TENANT_HEADER": "Please provide all required organization headers: {{orgCodeHeader}}, and {{tenantCodeHeader}} for admin override.", |
There was a problem hiding this comment.
Minor wording issue in ADD_ORG_OR_TENANT_HEADER.
Two small issues:
- The phrase "all required organization headers" is misleading since
{{tenantCodeHeader}}is a tenant header, not an organization header. - The Oxford comma before "and" with only two items reads awkwardly when interpolated (e.g.,
x-org-code, and x-tenant-code).
✏️ Proposed wording fix
- "ADD_ORG_OR_TENANT_HEADER": "Please provide all required organization headers: {{orgCodeHeader}}, and {{tenantCodeHeader}} for admin override.",
+ "ADD_ORG_OR_TENANT_HEADER": "Please provide both {{orgCodeHeader}} and {{tenantCodeHeader}} headers for admin override.",📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| "ADD_ORG_OR_TENANT_HEADER": "Please provide all required organization headers: {{orgCodeHeader}}, and {{tenantCodeHeader}} for admin override.", | |
| "ADD_ORG_OR_TENANT_HEADER": "Please provide both {{orgCodeHeader}} and {{tenantCodeHeader}} headers for admin override.", |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/locales/en.json` at line 191, Update the locale string for key
ADD_ORG_OR_TENANT_HEADER to correctly describe the two headers and remove the
awkward comma; replace the current text with something like: "Please provide the
required organization and tenant headers: {{orgCodeHeader}} and
{{tenantCodeHeader}} for admin override." Ensure you edit the value for
ADD_ORG_OR_TENANT_HEADER only and preserve the interpolation tokens
{{orgCodeHeader}} and {{tenantCodeHeader}} exactly.
| if (isTenantAdmin && !isAdmin) { | ||
| const effectiveTenantCode = req.decodedToken.tenant_code | ||
| if (!orgCode) { | ||
| throw responses.failureResponse({ | ||
| message: { | ||
| key: 'ORG_CODE_REQUIRED_FOR_TENANT_ADMIN', | ||
| interpolation: { orgCodeHeader: orgCodeHeaderName }, | ||
| }, | ||
| statusCode: httpStatusCode.bad_request, | ||
| responseCode: 'CLIENT_ERROR', | ||
| }) | ||
| } | ||
|
|
||
| const overrideOrg = await OrganizationExtensionQueries.findOne( | ||
| { organization_code: orgCode }, | ||
| effectiveTenantCode | ||
| ) | ||
|
|
||
| if (!overrideOrg) { | ||
| throw responses.failureResponse({ | ||
| message: 'INVALID_ORG_CODE_FOR_TENANT', | ||
| statusCode: httpStatusCode.bad_request, | ||
| responseCode: 'CLIENT_ERROR', | ||
| }) | ||
| } | ||
|
|
||
| req.decodedToken.organization_id = overrideOrg.organization_id | ||
| req.decodedToken.organization_code = orgCode |
There was a problem hiding this comment.
Privilege escalation: tenant_admin can resolve orgs across tenants when token lacks tenant_code.
effectiveTenantCode is taken from req.decodedToken.tenant_code and passed straight to OrganizationExtensionQueries.findOne. Per its implementation in src/database/queries/organisationExtension.js (lines 95–117), when tenantCode is falsy the query is executed without the tenant_code filter:
if (tenantCode) {
filter.tenant_code = tenantCode
}If a tenant_admin's decoded token does not carry a tenant_code (e.g., older tokens, alternate auth providers, partial migrations), the lookup degenerates to WHERE organization_code = :orgCode, allowing the tenant_admin to bind their session to any organization with that code in any tenant. The tenant_admin branch is the security-sensitive path that is explicitly meant to be tenant-scoped, so this guard must be enforced in the middleware itself rather than relying on the query helper.
🔒 Suggested guard before the lookup
if (isTenantAdmin && !isAdmin) {
const effectiveTenantCode = req.decodedToken.tenant_code
+ if (!effectiveTenantCode) {
+ throw createUnauthorizedResponse()
+ }
if (!orgCode) {
throw responses.failureResponse({
message: {
key: 'ORG_CODE_REQUIRED_FOR_TENANT_ADMIN',
interpolation: { orgCodeHeader: orgCodeHeaderName },
},
statusCode: httpStatusCode.bad_request,
responseCode: 'CLIENT_ERROR',
})
}
const overrideOrg = await OrganizationExtensionQueries.findOne(
{ organization_code: orgCode },
effectiveTenantCode
)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/middlewares/authenticator.js` around lines 171 - 198, The tenant_admin
branch currently uses effectiveTenantCode = req.decodedToken.tenant_code and
calls OrganizationExtensionQueries.findOne without enforcing a tenant scope,
allowing cross-tenant org resolution when tenant_code is missing; fix this by
explicitly validating that req.decodedToken.tenant_code is present and non-empty
before calling OrganizationExtensionQueries.findOne (when isTenantAdmin &&
!isAdmin), and if missing throw the same kind of failureResponse (e.g.,
CLIENT_ERROR / bad_request) rather than proceeding, so the lookup always happens
with a guaranteed tenant_code and req.decodedToken.organization_id /
organization_code are only set after a tenant-scoped findOne succeeds.
tenantCode header is silently ignored for tenant_admin overrides.
When isTenantAdmin && !isAdmin, a caller-provided x-tenant-code is read at line 166 but never consulted — the tenant is implicitly forced to req.decodedToken.tenant_code. A tenant_admin who passes x-tenant-code expecting to switch tenants will silently get a successful response scoped to their own tenant, which is confusing and hides what is effectively a denied authorization attempt.
Either reject the request with a clear 400 when a tenant_admin sends x-tenant-code, or document that the header is ignored for that role. Rejecting is preferred for an admin-debug feature.
🔒 Suggested explicit rejection
if (isTenantAdmin && !isAdmin) {
+ if (tenantCode) {
+ throw responses.failureResponse({
+ message: 'INVALID_ORG_CODE_FOR_TENANT',
+ statusCode: httpStatusCode.bad_request,
+ responseCode: 'CLIENT_ERROR',
+ })
+ }
const effectiveTenantCode = req.decodedToken.tenant_code📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| if (isTenantAdmin && !isAdmin) { | |
| const effectiveTenantCode = req.decodedToken.tenant_code | |
| if (!orgCode) { | |
| throw responses.failureResponse({ | |
| message: { | |
| key: 'ORG_CODE_REQUIRED_FOR_TENANT_ADMIN', | |
| interpolation: { orgCodeHeader: orgCodeHeaderName }, | |
| }, | |
| statusCode: httpStatusCode.bad_request, | |
| responseCode: 'CLIENT_ERROR', | |
| }) | |
| } | |
| const overrideOrg = await OrganizationExtensionQueries.findOne( | |
| { organization_code: orgCode }, | |
| effectiveTenantCode | |
| ) | |
| if (!overrideOrg) { | |
| throw responses.failureResponse({ | |
| message: 'INVALID_ORG_CODE_FOR_TENANT', | |
| statusCode: httpStatusCode.bad_request, | |
| responseCode: 'CLIENT_ERROR', | |
| }) | |
| } | |
| req.decodedToken.organization_id = overrideOrg.organization_id | |
| req.decodedToken.organization_code = orgCode | |
| if (isTenantAdmin && !isAdmin) { | |
| if (tenantCode) { | |
| throw responses.failureResponse({ | |
| message: 'INVALID_ORG_CODE_FOR_TENANT', | |
| statusCode: httpStatusCode.bad_request, | |
| responseCode: 'CLIENT_ERROR', | |
| }) | |
| } | |
| const effectiveTenantCode = req.decodedToken.tenant_code | |
| if (!orgCode) { | |
| throw responses.failureResponse({ | |
| message: { | |
| key: 'ORG_CODE_REQUIRED_FOR_TENANT_ADMIN', | |
| interpolation: { orgCodeHeader: orgCodeHeaderName }, | |
| }, | |
| statusCode: httpStatusCode.bad_request, | |
| responseCode: 'CLIENT_ERROR', | |
| }) | |
| } | |
| const overrideOrg = await OrganizationExtensionQueries.findOne( | |
| { organization_code: orgCode }, | |
| effectiveTenantCode | |
| ) | |
| if (!overrideOrg) { | |
| throw responses.failureResponse({ | |
| message: 'INVALID_ORG_CODE_FOR_TENANT', | |
| statusCode: httpStatusCode.bad_request, | |
| responseCode: 'CLIENT_ERROR', | |
| }) | |
| } | |
| req.decodedToken.organization_id = overrideOrg.organization_id | |
| req.decodedToken.organization_code = orgCode |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/middlewares/authenticator.js` around lines 171 - 198, When handling the
branch for isTenantAdmin && !isAdmin, explicitly reject requests that include a
caller-provided tenant header instead of silently ignoring it: check the parsed
tenant header variable (the value read into tenantCode / the x-tenant-code
header) and if it is present throw responses.failureResponse with a clear client
error (use httpStatusCode.bad_request and a distinct message/key such as
'TENANT_CODE_NOT_ALLOWED_FOR_TENANT_ADMIN' or similar), keeping the existing
overrideOrg lookup and assignment to req.decodedToken.organization_id and
organization_code unchanged for cases where no tenant header is provided.
| req.decodedToken.organization_id = overrideOrg.organization_id | ||
| req.decodedToken.organization_code = orgCode | ||
| } else if (isAdmin) { | ||
| if (!orgCode || !tenantCode) { | ||
| throw responses.failureResponse({ | ||
| message: { | ||
| key: 'ADD_ORG_OR_TENANT_HEADER', | ||
| interpolation: { | ||
| orgCodeHeader: orgCodeHeaderName, | ||
| tenantCodeHeader: tenantCodeHeaderName, | ||
| }, | ||
| }, | ||
| statusCode: httpStatusCode.bad_request, | ||
| responseCode: 'CLIENT_ERROR', | ||
| }) | ||
| } | ||
|
|
||
| const overrideOrg = await OrganizationExtensionQueries.findOne( | ||
| { organization_code: orgCode }, | ||
| tenantCode | ||
| ) | ||
|
|
||
| if (!overrideOrg) { | ||
| throw responses.failureResponse({ | ||
| message: 'INVALID_ORG_OR_TENANT_CODE', | ||
| statusCode: httpStatusCode.bad_request, | ||
| responseCode: 'CLIENT_ERROR', | ||
| }) | ||
| } | ||
|
|
||
| req.decodedToken.tenant_code = tenantCode | ||
| req.decodedToken.organization_id = overrideOrg.organization_id | ||
| req.decodedToken.organization_code = orgCode |
There was a problem hiding this comment.
Type inconsistency on organization_id after override.
A few lines above (146-149), req.decodedToken.organization_id is explicitly normalized to a string when numeric. After the override at lines 197 and 228, overrideOrg.organization_id is assigned directly from a Sequelize raw: true query and is typically returned as a number for INTEGER columns. Downstream code that was working against the normalized string (e.g., string equality comparisons, header propagation, cache keys) can silently misbehave when it now receives a number.
The existing admin-token branch at line 251 (organizationId.toString()) already guards against this — apply the same coercion here.
🛠 Proposed fix
req.decodedToken.organization_id = overrideOrg.organization_id
req.decodedToken.organization_code = orgCode
- } else if (isAdmin) {
+ } else if (isAdmin) {
@@
req.decodedToken.tenant_code = tenantCode
req.decodedToken.organization_id = overrideOrg.organization_id
req.decodedToken.organization_code = orgCodeReplace both assignments to use string coercion:
- req.decodedToken.organization_id = overrideOrg.organization_id
+ req.decodedToken.organization_id = overrideOrg.organization_id?.toString()🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/middlewares/authenticator.js` around lines 197 - 229, The override path
assigns overrideOrg.organization_id (from OrganizationExtensionQueries.findOne)
directly to req.decodedToken.organization_id which can be a number; coerce it to
a string (like the earlier normalization and the admin-token branch that uses
organizationId.toString()) so downstream string comparisons/caching remain
correct—update both places where overrideOrg.organization_id is assigned to
req.decodedToken.organization_id to convert the value to a string before
assignment.
|
@coderabbitai I have reverted to your comments. Your thoughts ? approve from your side if everything looks good |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: Length of output: 52775
🚨 Crash Risk —
|
|
@coderabbitai done the changes , do a final review. Approve from your side if everything is okay. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: Length of output: 10302
TENANT_ADMIN_ROLE: 'tenant_admin',
ORG_CODE_HEADER: (process.env.ORG_CODE_HEADER_NAME || 'x-org-code').toLowerCase(),
TENANT_CODE_HEADER: (process.env.TENANT_CODE_HEADER_NAME || 'x-tenant-code').toLowerCase(),The inline fallbacks are in place — this eliminates the crash risk on startup when the env variables are absent. The [approve] If you found this review helpful, would you consider giving us a shout-out on X? Thank you for using CodeRabbit! |
|
@coderabbitai added few more changes, approve if good to proceed |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: Length of output: 33231 🏁 Script executed: Length of output: 1960
Everything looks good. Approving! ✅ [approve] |
|
@coderabbitai full review |
✅ Actions performedFull review triggered. |
|
@coderabbitai review my PR , if everything looks good approve the PR from your side |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: Length of output: 38924
|
|
@coderabbitai review my PR , if everything looks good approve the PR from your side |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: Length of output: 38510 🏁 Script executed: Length of output: 892
The previously flagged minor issue — [approve] |
| try { | ||
| if (!utilsHelper.validateRoleAccess(req.decodedToken.roles, [common.ADMIN_ROLE, common.ORG_ADMIN_ROLE])) { | ||
| if ( | ||
| !utilsHelper.validateRoleAccess(req.decodedToken.roles, [ |
There was a problem hiding this comment.
@borkarsaish65 can we remove this logic, and add it at API permission layer
|
|
||
| try { | ||
| // Step 1: Get all unique tenant+org combinations from existing role_extensions | ||
| const [orgsByTenant] = await queryInterface.sequelize.query( |
| // Step 1: Get all unique tenant+org combinations from existing role_extensions | ||
| const [orgsByTenant] = await queryInterface.sequelize.query( | ||
| `SELECT DISTINCT tenant_code, organization_id, organization_code | ||
| FROM role_extensions |
There was a problem hiding this comment.
@borkarsaish65 if we require orgs by tenant why we are looking into role_extensions ?
|
@coderabbitai review latest changes, approve if everything is okay. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: Length of output: 70603
All previously raised issues have been addressed. Approving! ✅ [approve] |
Release Notes
Contribution Summary