From 29169ff69326b00199bd56499b91118646db075f Mon Sep 17 00:00:00 2001 From: MoonWindow Date: Tue, 21 Jul 2026 04:42:05 +0800 Subject: [PATCH] fix: read user role from request.state.user in scenarios RBAC The /api/scenarios handler read the role via getattr(request.state, "role", "admin"), but AuthMiddleware stores the authenticated user as request.state.user (a dict), never as request.state.role. The attribute is therefore always missing and the lookup falls back to "admin", so the per-scene access.roles filter never excludes anyone: viewer/analyst users see scenes restricted to roles they do not hold. Use get_current_user(request).get("role", "viewer"), consistent with every other handler in this file. --- api/main.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/api/main.py b/api/main.py index cd015dc..450126a 100644 --- a/api/main.py +++ b/api/main.py @@ -1504,8 +1504,8 @@ def delete_session(session_id: str): def get_scenarios(request: Request): """Get all scenarios for the current user, with V2 RBAC filtering.""" try: - # Get user role from auth - user_role = getattr(request.state, "role", "admin") if hasattr(request, "state") else "admin" + # Get user role from auth (middleware stores the user dict on request.state.user) + user_role = get_current_user(request).get("role", "viewer") r = _ddb.Table(CONFIG_TABLE).get_item(Key={"config_key": "scenarios"}) data = r.get("Item", {}).get("data", "{}")