- Sponsor
-
Notifications
You must be signed in to change notification settings - Fork 87
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix Super Admin User Login issue #1802
Comments
@JackHaeg But we have another big problem This is happening because as I checked, a lot of parts of VRMS are only visible to users that have accessLevel = "ADMIN", for example user edit screen, event creation etc. We have two options, I would like to know your opinions @trillium @jbubar @bkmorgan3
|
@trillium Please provide next steps for Nikhil as discussed on call (while considering delivery timeline of 2-3 weeks) |
I'd prefer us to create an function isAdmin(user) {
user.accessLevel('admin' || 'superadmin') {
return true
}
return false
} and then swap that function in where the comparisons are added for " === 'admin' " is requested in the app |
@ntrehan Just checking in on this issue:
|
// change user.middleware.js to
const { User } = require('../models');
function checkDuplicateEmail(req, res, next) {
User.findOne({ email: req.body.email }).then((user) => {
if (user) {
return res.sendStatus(400);
}
next();
});
}
function isAdminByEmail(req, res, next) {
User.findOne({ email: req.body.email }).then((user) => {
if (!user) {
return res.sendStatus(400);
} else {
const role = user.accessLevel;
if (role.includes('admin') || user.managedProjects.length > 0) { // changes added here with .includes()
next();
} else {
next(res.sendStatus(401));
}
}
});
}
const verifyUser = {
checkDuplicateEmail,
isAdminByEmail,
};
module.exports = verifyUser; |
@ntrehan just checking in! Do you have any updates on this fix (ETA, blockers, etc.)? |
Hi @ntrehan! Checking in one last time to see if you are still interested / available to work on this issue. If you are no longer available, we will likely unassign you and move this issue back to the prioritized backlog for another developer to work on. Hope all is well! |
Hi @ntrehan! When you have a moment, can you please provide an update with the following information:
|
|
Thanks for this update and for all of your work, @ntrehan! I will add this to tonight's agenda to highlight the review to the team. |
Overview
After implementing the Super Admin User feature in #1747, we identified a bug where the Super Admin User ([email protected]) is unable to log in to VRMS. This issue tracks the fix for this bug.
Past Research
Bug summary from Jack Haeger_2024-10-17
Trillium merged the Super User PR, rebuilt Dev, and edited the DB to make [email protected] a super user.
The good news is that almost everything is working as expected (the user screen is grayed out and no other admin users can edit this user).
The bad news is that we cannot log in with this user to dev.vrms.io:
Nikhil's research_2024-10-22
The checkAuth Method has authOrigin Set to LOG_IN

It fetches SIGN_IN

Which is exposed by this route

That router works in this way

and it checks for a method called verifyUser.isAdminByEmai
And voila

if (role === 'admin' || user.managedProjects.length > 0)
It is allowing either "admin"
or someone who has managedProjects.length>0
Now if we look at the super user

Neither are they "admin" and their "managedProjects" empty
So they are not able to log in
But when you see Trillium's profile, Jack Haeger told me that when converting Trillium to super-user, he was still able to log in because the managedProjects list is not empty!

Action Items
"Success" Screenshot
Error message screenshot
Resources/Instructions
The text was updated successfully, but these errors were encountered: