feat: Allow project admins to create users which are not a system adm…

…in (DEV-3266) (#3099)
dasch-swiss · Mar 6, 2024 · 79e1963 · 79e1963
1 parent b56580d
commit 79e1963
Show file tree

Hide file tree

Showing 2 changed files with 25 additions and 1 deletion.
diff --git a/integration/src/test/scala/org/knora/webapi/e2e/admin/UsersADME2ESpec.scala b/integration/src/test/scala/org/knora/webapi/e2e/admin/UsersADME2ESpec.scala
@@ -460,6 +460,29 @@ class UsersADME2ESpec
     }
 
     "used to create a user" should {
+      "not allow a projectAdmin to create a System Admin" in {
+        val createUserRequest: String =
+          s"""{
+             |    "username": "daisy.duck",
+             |    "email": "[email protected]",
+             |    "givenName": "Daisy",
+             |    "familyName": "Duck",
+             |    "password": "test",
+             |    "status": true,
+             |    "lang": "en",
+             |    "systemAdmin": true
+             |}""".stripMargin
+
+        val request = Post(
+          baseApiUrl + s"/admin/users",
+          HttpEntity(ContentTypes.`application/json`, createUserRequest),
+        ) ~> addProjectAdminUserCredentials()
+
+        val response: HttpResponse = singleAwaitingRequest(request)
+
+        response.status should be(StatusCodes.Forbidden)
+      }
+
       "create the user if the supplied email and username are unique" in {
         val createUserRequest: String =
           s"""{

diff --git a/webapi/src/main/scala/org/knora/webapi/slice/admin/api/service/UsersRestService.scala b/webapi/src/main/scala/org/knora/webapi/slice/admin/api/service/UsersRestService.scala
@@ -87,7 +87,8 @@ final case class UsersRestService(
 
   def createUser(requestingUser: User, userCreateRequest: Requests.UserCreateRequest): Task[UserResponseADM] =
     for {
-      _        <- auth.ensureSystemAdmin(requestingUser)
+      _ <- if (userCreateRequest.systemAdmin.value) { auth.ensureSystemAdmin(requestingUser) }
+           else { auth.ensureSystemAdminOrProjectAdminInAnyProject(requestingUser) }
       internal <- knoraUserService.createNewUser(userCreateRequest)
       external <- asExternalUserResponseADM(requestingUser, internal)
     } yield external