fix: 기관 계층에 시스템 계층 계정 미제공 - #130
Merged
Merged
Conversation
The account directory is the one admin read not narrowed by organisation, which is what lets an administrator reach someone who has requested nothing. That opening also hands the org tier every system account, and those are the accounts it can do nothing with: grantOrgRole refuses a sys-tier target and the account-state writes are SYS_ADMIN-only. An administrator should be able to act on every account it is shown, so these are withheld (operator, 2026-09-16). This is a role boundary, not an organisation one, and it leaves the unscoped ruling standing. The list withholds them in the where clause rather than after the fetch, so the count and the page boundaries agree with the rows; the set comes from the enum rather than a literal, so a fourth system role cannot be withheld from the detail while the list keeps handing it out. The detail answers 404 rather than 403, the masking an organisation outside the actor's already gets, because an id that still opens the detail makes the exclusion decoration. No operation and no schema change, so the contract version stands.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📝 작업내용
listUsers가 기관 계층 호출자에게 시스템 계층 계정을 제외, where 절에서 거르므로 총 건수와 페이지 경계가 행과 일치UserRole.isSysTier()에서 도출, 시스템 역할이 늘어도 목록과 상세가 갈라지지 않음getUser도 같은 경계에서 404, 목록에서 빼고 상세를 열어 두면 id 하나로 되돌아감⭐️ 검증
AdminUsersTest5건과ContractDriftTest6건 통과, 생성 명세 무변화 확인systemTierAccountsAreWithheldFromTheOrgTier가totalElements0 대신 1로 실패role=SYS_ADMIN조회의 총 건수가 0인지까지 확인하므로, 조회 후 거르는 구현으로는 미통과💬 리뷰 포인트
grantOrgRole은 지금도 403에 사유를 담아 답하며 그 동작은 SYS_ADMIN에게도 동일