raystack / frontier / 28434219624

44%

main: 44%

Pull #1716

github

fix(authz): allow platform superusers to delete and read policies on deleted resources

DeletePolicy and GetPolicy authorize against the policy's resource. When the
project or group has been deleted, that resource has no relationships left, so
the permission check can't resolve a path to superuser and even a platform
superuser is denied. This leaves policies on deleted resources impossible to
remove through the API.

Allow a platform superuser through both checks before the resource-scoped check
runs. Non-superusers are unaffected and still need policy-manage on the resource.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

0 of 13 new or added lines in 1 file covered. (0.0%)

16233 of 37071 relevant lines covered (43.79%)

12.38 hits per line