mirror of
https://github.com/quay/quay.git
synced 2026-01-26 06:21:37 +03:00
86b50f48c3
This fixes a bug where global readonly superusers were incorrectly blocked from accessing organization logs when FEATURE_SUPERUSERS_FULL_ACCESS was set to false. Changes: - Updated OrgLogs.get() to allow global readonly superusers - Updated OrgAggregateLogs.get() to allow global readonly superusers - Updated ExportOrgLogs.post() to allow global readonly superusers - Added comprehensive tests verifying the fix The fix ensures that: 1. Global readonly superusers can ALWAYS access organization logs for auditing purposes, regardless of FEATURE_SUPERUSERS_FULL_ACCESS setting 2. Regular superusers are still blocked from accessing organization logs when FEATURE_SUPERUSERS_FULL_ACCESS is false (correct behavior) All three endpoints now use consistent permission logic: permission.can() OR allow_if_global_readonly_superuser() OR allow_if_superuser_with_full_access() 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude <noreply@anthropic.com>