fix(authorization): Fix hierarchy filters for superusers

oheger-bosch · oheger-bosch · commit 04a8f286572c · 2025-11-07T14:31:22.000+01:00
The filter's `isWildcard` flag was always set to `true` for
superusers. This prevented the `containedIn` filter to be applied
correctly. Fix this by taking the presence of a `containedIn` filter into
account.

Signed-off-by: Oliver Heger &lt;oliver.heger@bosch.com&gt;
diff --git a/components/authorization/backend/src/main/kotlin/service/DbAuthorizationService.kt b/components/authorization/backend/src/main/kotlin/service/DbAuthorizationService.kt
@@ -217,7 +217,7 @@ class DbAuthorizationService(
         return HierarchyFilter(
             transitiveIncludes = includes,
             nonTransitiveIncludes = permissions.implicitIncludes().filterContainedIn(containedInId),
-            isWildcard = permissions.isSuperuser()
+            isWildcard = permissions.isSuperuser() && containedInId == null
         )
     }
 
diff --git a/components/authorization/backend/src/test/kotlin/service/DbAuthorizationServiceTest.kt b/components/authorization/backend/src/test/kotlin/service/DbAuthorizationServiceTest.kt
@@ -1120,6 +1120,7 @@ class DbAuthorizationServiceTest : WordSpec() {
                     containedIn = repositoryCompoundId.productId
                 )
 
+                filter.isWildcard shouldBe false
                 filter.transitiveIncludes.entries.shouldBeSingleton { (key, value) ->
                     key shouldBe CompoundHierarchyId.PRODUCT_LEVEL
                     value shouldBe setOf(repositoryCompoundId.parent)

Original file line number	Diff line number	Diff line change
`@@ -217,7 +217,7 @@ class DbAuthorizationService(`
`217`	`217`	`return HierarchyFilter(`
`218`	`218`	`transitiveIncludes = includes,`
`219`	`219`	`nonTransitiveIncludes = permissions.implicitIncludes().filterContainedIn(containedInId),`
`220`		`- isWildcard = permissions.isSuperuser()`
	`220`	`+ isWildcard = permissions.isSuperuser() && containedInId == null`
`221`	`221`	`)`
`222`	`222`	`}`
`223`	`223`
Original file line number	Diff line number	Diff line change
`@@ -1120,6 +1120,7 @@ class DbAuthorizationServiceTest : WordSpec() {`
`1120`	`1120`	`containedIn = repositoryCompoundId.productId`
`1121`	`1121`	`)`
`1122`	`1122`
	`1123`	`+ filter.isWildcard shouldBe false`
`1123`	`1124`	`filter.transitiveIncludes.entries.shouldBeSingleton { (key, value) ->`
`1124`	`1125`	`key shouldBe CompoundHierarchyId.PRODUCT_LEVEL`
`1125`	`1126`	`value shouldBe setOf(repositoryCompoundId.parent)`