From f3896624f5f17e01c732a621f2a1c3f6686b0de2 Mon Sep 17 00:00:00 2001 From: Jo Date: Wed, 6 Aug 2025 10:25:06 +0200 Subject: [PATCH] Access: Remove plugin app access in plugin basic role seeder (#108526) * draft: remove plugin app access in plugin basic role seeder * fix log * remove mods to gosum * fix missing plugin check * debug log, not warn * Secrets: Better error message for not matching resource owner (#109113) --------- Co-authored-by: Matheus Macabu --- pkg/services/accesscontrol/acimpl/service.go | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/pkg/services/accesscontrol/acimpl/service.go b/pkg/services/accesscontrol/acimpl/service.go index 9f54215a061..86adbdbfcb0 100644 --- a/pkg/services/accesscontrol/acimpl/service.go +++ b/pkg/services/accesscontrol/acimpl/service.go @@ -430,6 +430,11 @@ func (s *Service) RegisterFixedRoles(ctx context.Context) error { for br := range accesscontrol.BuiltInRolesWithParents(registration.Grants) { if basicRole, ok := s.roles[br]; ok { for _, p := range registration.Role.Permissions { + if registration.Role.IsPlugin() && p.Action == pluginaccesscontrol.ActionAppAccess { + s.log.Debug("Plugin is attempting to grant access permission, but this permission is already granted by default and will be ignored", + "role", registration.Role.Name, "permission", p.Action, "scope", p.Scope) + continue + } perm := accesscontrol.Permission{ Action: p.Action, Scope: p.Scope,