Merge branch 'develop' into 'main'

chore: Add member activation check for enterprise and group password permissions

See merge request locker/api-core!621

Author: khaitranquang

locker_server/api/permissions/locker_permissions/enterprise_permissions/enterprise_pwd_permission.py

@@ -2,7 +2,8 @@
 
 from locker_server.api.permissions.app import APIPermission
 from locker_server.core.exceptions.enterprise_member_exception import EnterpriseMemberDoesNotExistException
-from locker_server.shared.constants.enterprise_members import E_MEMBER_ROLE_PRIMARY_ADMIN, E_MEMBER_ROLE_ADMIN
+from locker_server.shared.constants.enterprise_members import E_MEMBER_ROLE_PRIMARY_ADMIN, E_MEMBER_ROLE_ADMIN, \
+    E_MEMBER_STATUS_CONFIRMED
 from locker_server.containers.containers import enterprise_member_service
 
 
@@ -40,3 +41,8 @@ def get_enterprise_member(user, obj):
             return enterprise_member
         except EnterpriseMemberDoesNotExistException:
             raise PermissionDenied
+
+    @staticmethod
+    def is_activated_member(member):
+        # An active, fully-joined member: confirmed invitation and not deactivated/suspended.
+        return member.status == E_MEMBER_STATUS_CONFIRMED and member.is_activated

locker_server/api/permissions/locker_permissions/enterprise_permissions/group_pwd_permission.py

@@ -1,3 +1,5 @@
+from rest_framework.permissions import SAFE_METHODS
+
 from locker_server.api.permissions.locker_permissions.enterprise_permissions.enterprise_pwd_permission import \
     EnterprisePwdPermission
 from locker_server.shared.constants.enterprise_members import E_MEMBER_ROLE_PRIMARY_ADMIN, E_MEMBER_ROLE_ADMIN, \
@@ -16,6 +18,11 @@ def has_object_permission(self, request, view, obj):
         member = self.get_enterprise_member(user=request.user, obj=obj)
         role = member.role
         role_name = role.name
+        # Write actions (members PUT, create/update/destroy) require an active, confirmed member:
+        # a deactivated or still-pending admin must not be able to change group membership or
+        # silently grant/revoke shared-vault access.
+        if request.method not in SAFE_METHODS and not self.is_activated_member(member):
+            return False
         if view.action in ["members_list"]:
             return role_name in [E_MEMBER_ROLE_PRIMARY_ADMIN, E_MEMBER_ROLE_ADMIN, E_MEMBER_ROLE_MEMBER]
         return role_name in [E_MEMBER_ROLE_PRIMARY_ADMIN, E_MEMBER_ROLE_ADMIN]