fix auth: sp.{service}.admins groups provisioning

2024-12-29 02:20:54 +04:00
parent bc8f998176
commit 7f9f7a4db2
1 changed files with 5 additions and 1 deletions
--- a/sp-modules/auth/kanidm.nix
+++ b/sp-modules/auth/kanidm.nix
@@ -126,10 +126,14 @@ let

  filterPresent = filterAttrs (_: v: v.present);

+  selfprivacy-admin-groups-regex = "^sp\.([[:alnum:]]+\.|)admins$";
+  is-selfprivacy-admin-group = name:
+    ! builtins.isNull (builtins.match selfprivacy-admin-groups-regex name);
+
  isGroupNonOverwritable = g: false
    || ! g ? members
    || g ? members && g.members == [ ]
-    || g ? members && g.members == [ "sp.admins" ];
+    || g ? members && builtins.any is-selfprivacy-admin-group g.members;

  provisionStateJson = pkgs.writeText "provision-state.json" (
    builtins.toJSON {