You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The Leder flag is stored per worker. It is keyed by the worker's SDK site, using Microting.EformBackendConfigurationBase 10.0.62 (LederAssignments.SiteId).
An admin can set or clear Leder on any worker, whatever its access: no login, Web/Arkiv off, or an admin login. Nothing else changes on save, and no access is switched on.
LederRequiresLogin, the automatic revoke and the "loses access" refusal are gone.
A non-admin still cannot change a Leder worker's e-mail or its login's username (H2). Moving between two unlisted addresses (blank and the placeholder) does not count as a change.
Who is a Leder: a login is a Leder when it is active and one of its live sites is flagged. ILederService takes the already-known IsActive and live site ids (LederLiveness) instead of knownLive. A tenant with no flagged site skips the SDK lookup.
Delete and list: deleting a worker revokes its site's flag. isLeader is true/false on every Medarbejdere row, from one query per list.
Old rows: rows written per login are converted once at startup to their workers' sites (LederLegacyConversionService). One failing row does not block the others, and a failure never stops the plugin loading.
Web:
The Leder toggle is shown to admins on every worker and is always enabled.
A Leder column (Ja/Nej, the Archive column's badges) replaces the chip, for every viewer.
Two hint keys are removed from all locales.
Playwright:zc is updated.
Deploy note: on a tenant that already runs the per-login Leder release (staging), an old pod's Medarbejdere list fails once per-site rows exist. The old base maps EformUserId as non-nullable. Roll that tenant with recreate, or accept the short gap until the old pod is gone.
Not run locally: the C# tests, Angular unit tests and Playwright run only in CI. Locally, only dotnet build was run.
…ins (#1502)
- leader.helper: the toggle shows for admins on every worker; Ja/Nej cell helper.
- Worker dialog: the Leder toggle is always enabled; isLeader is sent only when changed.
- Medarbejdere: a Leder column with the Archive column's Ja/Nej badges replaces the chip.
- Every locale: the two disabled-toggle hints are dropped.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The reason will be displayed to describe this comment to others. Learn more.
🟡 Changes recommended
Legacy conversion can restore revoked permissions through partial or concurrent replay, new tests fail TypeScript excess-property checks, and Leder-only edits remain blocked for existing workers without e-mail or access.
The reason will be displayed to describe this comment to others. Learn more.
🟡 Changes recommended
Critical flaws allow non-admins to bypass Leder identity protections through shared workers and let partially committed legacy conversions restore explicitly revoked access on restart.
Saving only Leder on an addressless worker still replaces its empty address with a placeholder and creates a login with a fallback group before reaching this flag write. That changes the worker's address and account state rather than only storing Leder. Preserve both for a Leder-only edit, and extend the no-address grant test to assert that the stored address and user count remain unchanged.
Match legacy worker addresses using sanitizer semantics
This raw address comparison loses legacy flags for workers whose stored address needs the sanitizer fallback. For example, a worker stored as jane@example.com is linked to the jane@example.com login by the existing save/list lookup, but this query finds no worker; the converter then permanently removes the legacy assignment without flagging its site. Resolve legacy workers using the same WorkerEmailSanitizer.Clean matching semantics before retiring the row, and cover a padded legacy address in the conversion tests.
…of the worker (#1502)
- The startup conversion locks each legacy row, re-reads it and skips it when another
pod already retired it; its site grants and its retirement commit together, so a
failure or a second pod cannot replay a grant over a later revoke.
- A non-admin cannot change the e-mail of a worker when any of the worker's live
sites is a Leder, not only the site being edited.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The reason will be displayed to describe this comment to others. Learn more.
🟡 Changes recommended
A non-admin can rename a protected Leder login through a different, unflagged worker because the authorization check ignores sites associated with the resolved login’s current email.
The reason will be displayed to describe this comment to others. Learn more.
🔵 Needs a closer look
The startup authorization migration needs MariaDB CI validation of concurrent-start and rollback behavior, plus deployment-owner confirmation of the recreate rollout because old pods cannot read the new per-site rows.
…1502)
A login whose UserName drifted from its Email can be found by another
worker's address. A non-admin save or create through that worker would
rename the Leder's login; both are now refused when the login's own
e-mail resolves to a flagged live site.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The reason will be displayed to describe this comment to others. Learn more.
🟡 Changes recommended
A critical authorization gap lets non-admins rename logins belonging to resigned workers through another address with a matching username because the protection excludes resigned workers.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1502
Microting.EformBackendConfigurationBase10.0.62 (LederAssignments.SiteId).LederRequiresLogin, the automatic revoke and the "loses access" refusal are gone.ILederServicetakes the already-knownIsActiveand live site ids (LederLiveness) instead ofknownLive. A tenant with no flagged site skips the SDK lookup.isLeaderis true/false on every Medarbejdere row, from one query per list.LederLegacyConversionService). One failing row does not block the others, and a failure never stops the plugin loading.zcis updated.Deploy note: on a tenant that already runs the per-login Leder release (staging), an old pod's Medarbejdere list fails once per-site rows exist. The old base maps
EformUserIdas non-nullable. Roll that tenant with recreate, or accept the short gap until the old pod is gone.Not run locally: the C# tests, Angular unit tests and Playwright run only in CI. Locally, only
dotnet buildwas run.🤖 Generated with Claude Code