26761988008
89%

Ran 01 Jun 2026 02:50PM UTC

Jobs 1

Files 964

Run time 2min

Badge

Embed ▾

Committed 01 Jun 2026 02:41PM UTC coverage: 88.078% (+0.03%) from 88.046%

Build # 26761988008

Build Type

push

github

Committed by

web-flow

Commit Message

Prevent role escalation in user/service-account forms (#1493)

A non-superuser editing another user's groups can now only add groups
they themselves belong to — the escalation-prevention pattern from K8s
RBAC and AWS permission boundaries. Implemented as
RoleMembershipGrantMixin shared by UpdateUserForm and
ServiceAccountForm: rejects added groups in clean() and renders them
as disabled options in the multi-select. Removals are unrestricted by
design — escalation risk is granting, not revoking.

Also relabels the auto-generated M2M field as "Roles" to match the
rest of the UI, drops the auth-default help text that referenced
permissions, widens the widget, and moves the disabled-options
SelectMultiple to zentral/utils/forms.py for reuse.

Co-authored-by: Sebastian Fuchs <sebastian@zentral.com>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

Coverage Stats

46329 of 52600 relevant lines covered (88.08%)

0.88 hits per line

Coverage Regressions

Lines	Coverage	∆	File
33	90.63	1.33%	server/accounts/forms.py

Jobs

ID	Job ID	Ran	Files	Coverage
1	26761988008.1	01 Jun 2026 02:50PM UTC	964	88.08	GitHub Action Run

zentralopensource / zentral / 26761988008
89%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Coverage Regressions

Jobs

Source Files on build 26761988008

zentralopensource / zentral / 26761988008 89%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Coverage Regressions

Jobs

Source Files on build 26761988008

zentralopensource / zentral / 26761988008
89%

README BADGES
x