26921906730
61%
main: 61%

Ran 04 Jun 2026 12:32AM UTC

Jobs 1

Files 13

Run time 1min

Badge

Embed ▾

Committed 04 Jun 2026 12:26AM UTC coverage: 60.861%. First build

Build # 26921906730

Build Type

push

github

Committed by

jtschladen

Commit Message

fix: block read-only users from write ops without requiring admin/operator

The GHSA-qcqw-jwxc-2hqg fix changed LEMUR_STRICT_ROLE_ENFORCEMENT to
default True, which correctly closed the empty-needs Flask-Principal
bypass but broke normal cert issuance, uploads, and notification
management for users with custom group roles.

The actual vulnerability was read-only users bypassing write checks.
Fix StrictRolePermission.allows() to explicitly deny identities with
the read-only role when strict mode is off, rather than requiring
admin/operator for all write operations. Revert the default back to
False and apply the same default revert in users/service.py.

ADMIN_ONLY_AUTHORITY_CREATION remains True — authority creation is
genuinely an admin action.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Coverage Stats

594 of 976 relevant lines covered (60.86%)

0.61 hits per line

Jobs

ID	Job ID	Ran	Files	Coverage
1	Python 3.11 Postgres 17 OS ubuntu-22.04 - 26921906730.1	04 Jun 2026 12:32AM UTC	13	60.86	GitHub Action Run

jtschladen / lemur / 26921906730
61%
main: 61%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 26921906730

jtschladen / lemur / 26921906730 61% main: 61%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 26921906730

jtschladen / lemur / 26921906730
61%
main: 61%

README BADGES
x