fix: Disable role change when OIDC roles are not ignored

server/api/controllers/users/update.js

@@ -73,6 +73,10 @@ module.exports = {
       delete inputs.name;
       /* eslint-enable no-param-reassign */
     } else if (user.isSso) {
+      if (!sails.config.custom.oidcIgnoreRoles) {
+        delete inputs.isAdmin; // eslint-disable-line no-param-reassign
+      }
+
       delete inputs.name; // eslint-disable-line no-param-reassign
     }
 

server/api/helpers/users/get-or-create-one-using-oidc.js

@@ -90,11 +90,9 @@ module.exports = {
       });
     }
 
-    const updateFieldKeys = ['email', 'isAdmin', 'isSso', 'name', 'username'];
-
-    if (sails.config.custom.oidcIgnoreRoles) {
-      // Remove isAdmin from updateFieldKeys
-      updateFieldKeys.splice(updateFieldKeys.indexOf('isAdmin'), 1);
+    const updateFieldKeys = ['email', 'isSso', 'name', 'username'];
+    if (!sails.config.custom.oidcIgnoreRoles) {
+      updateFieldKeys.push('isAdmin');
     }
 
     const updateValues = {};

server/api/models/User.js

@@ -110,12 +110,13 @@ module.exports = {
   tableName: 'user_account',
 
   customToJSON() {
-    const isLockedAdmin = this.email === sails.config.custom.defaultAdminEmail;
+    const isDefaultAdmin = this.email === sails.config.custom.defaultAdminEmail;
 
     return {
       ..._.omit(this, ['password', 'isSso', 'avatar', 'passwordChangedAt']),
-      isLockedAdmin,
-      isLocked: this.isSso || isLockedAdmin,
+      isLocked: this.isSso || isDefaultAdmin,
+      isRoleLocked: (this.isSso && !sails.config.custom.oidcIgnoreRoles) || isDefaultAdmin,
+      isDeletionLocked: isDefaultAdmin,
       avatarUrl:
         this.avatar &&
         `${sails.config.custom.userAvatarsUrl}/${this.avatar.dirname}/square-100.${this.avatar.extension}`,

server/config/custom.js

@@ -39,7 +39,7 @@ module.exports.custom = {
   oidcScopes: process.env.OIDC_SCOPES || 'openid email profile',
   oidcAdminRoles: process.env.OIDC_ADMIN_ROLES ? process.env.OIDC_ADMIN_ROLES.split(',') : [],
   oidcRolesAttribute: process.env.OIDC_ROLES_ATTRIBUTE || 'groups',
-  oidcIgnoreRoles : process.env.OIDC_IGNORE_ROLES || false,
+  oidcIgnoreRoles: process.env.OIDC_IGNORE_ROLES === 'true',
 
   // TODO: move client base url to environment variable?
   oidcRedirectUri: `${

server/db/seeds/default.js

@@ -34,10 +34,6 @@ exports.seed = async (knex) => {
       createdAt: new Date().toISOString(),
     });
   } catch (error) {
-    if (Object.keys(data).length === 0) {
-      return;
-    }
-
     await knex('user_account').update(data).where('email', process.env.DEFAULT_ADMIN_EMAIL);
   }
 };