Registry testing - part 6

crates/common/src/auth/access_token.rs

@@ -17,7 +17,7 @@ use ahash::AHasher;
 use registry::{
     schema::{
         enums::Permission,
-        structs::{self, Account, Roles},
+        structs::{self, Account, Roles, UserRoles},
     },
     types::EnumImpl,
 };
@@ -46,10 +46,18 @@ impl Server {
                 let permissions = self
                     .effective_permissions(
                         &account.permissions,
-                        account
-                            .roles
-                            .role_ids()
-                            .unwrap_or(self.core.network.security.default_role_ids_user.as_slice()),
+                        match &account.roles {
+                            UserRoles::User => {
+                                self.core.network.security.default_role_ids_user.as_slice()
+                            }
+                            UserRoles::TenantAdmin => self
+                                .core
+                                .network
+                                .security
+                                .default_role_ids_tenant
+                                .as_slice(),
+                            UserRoles::Custom(custom_roles) => custom_roles.role_ids.as_slice(),
+                        },
                         tenant_id,
                     )
                     .await?;
@@ -731,8 +739,14 @@ fn hash_account(account: &Account) -> u64 {
         Account::User(account) => {
             account.member_tenant_id.hash(&mut s);
             match &account.roles {
-                Roles::Default => {}
-                Roles::Custom(custom_roles) => {
+                UserRoles::User => {
+                    0u8.hash(&mut s);
+                }
+                UserRoles::TenantAdmin => {
+                    1u8.hash(&mut s);
+                }
+                UserRoles::Custom(custom_roles) => {
+                    2u8.hash(&mut s);
                     custom_roles.role_ids.as_slice().hash(&mut s);
                 }
             }

crates/common/src/auth/permissions.rs

@@ -12,7 +12,7 @@ use ahash::AHashSet;
 use registry::{
     schema::{
         enums::Permission,
-        structs::{self, Account, PermissionsList},
+        structs::{self, Account, PermissionsList, UserRoles},
     },
     types::EnumImpl,
 };
@@ -112,10 +112,16 @@ impl Server {
         let (permissions, role_ids, tenant_id) = match account {
             Account::User(account) => (
                 &account.permissions,
-                account
-                    .roles
-                    .role_ids()
-                    .unwrap_or(self.core.network.security.default_role_ids_user.as_slice()),
+                match &account.roles {
+                    UserRoles::User => self.core.network.security.default_role_ids_user.as_slice(),
+                    UserRoles::TenantAdmin => self
+                        .core
+                        .network
+                        .security
+                        .default_role_ids_tenant
+                        .as_slice(),
+                    UserRoles::Custom(custom_roles) => custom_roles.role_ids.as_slice(),
+                },
                 account.member_tenant_id.map(|t| t.document_id()),
             ),
             Account::Group(account) => (

crates/common/src/cache/directory.rs

@@ -12,6 +12,7 @@ use registry::{
         prelude::{Object, ObjectType},
         structs::{
             Account, Credential, EmailAlias, GroupAccount, PasswordCredential, Roles, UserAccount,
+            UserRoles,
         },
     },
     types::{datetime::UTCDateTime, id::ObjectId, list::List},
@@ -180,7 +181,7 @@ impl Server {
                     description: account.description,
                     member_group_ids: member_group_ids.into(),
                     member_tenant_id: domain.id_tenant.map(Id::from),
-                    roles: Roles::Default,
+                    roles: UserRoles::User,
                     credentials: List::from_iter([Credential::Password(PasswordCredential {
                         secret: account.secret.unwrap_or_default(),
                         ..Default::default()

crates/common/src/cache/invalidate.rs

@@ -197,10 +197,10 @@ impl CacheInvalidationBuilder {
 impl Server {
     pub async fn invalidate_caches(&self, changes: CacheInvalidationBuilder) -> trc::Result<()> {
         let mut changes = changes.changes;
-        let c = println!("Invalidating caches for changes: {:?}", changes);
         if changes.is_empty() {
             return Ok(());
         }
+        let c = println!("Invalidating caches for changes: {:?}", changes);
 
         // Invalidate objects linking roles
         let mut role_ids = changes