Repository navigation
Prepare v6.0.1 maintenance release - #3626
Merged
Merged
Conversation
Generated by 🚫 Danger |
aaronskiba
reviewed
Nov 3, 2026
| def edit | ||
| @user = User.find(params[:id]) | ||
| authorize @user | ||
| authorize @user, :super_admin_edit? |
Contributor
There was a problem hiding this comment.
Good job including these actions in the fix. 🙏
Contributor
|
Thank you for digging into this one. I think I just found some buggy behaviour that can occur if a super-admin attempts to update a department and org together. #3627 |
alasdair-macleod
changed the title
Update user administration checks and record validation, with regression coverage and compatibility fixes. Detailed advisories will be published after release.
alasdair-macleod
force-pushed
the
release/6.0.1
branch
from
November 4, 2026 08:45
238fac6 to
512de87
Compare
Add request coverage for super admins changing a user's organization and department in the same update. This exposes a validation-order issue where the department is checked against the user's current organization.
Super-admin user updates saved the permitted attributes first, then applied the selected organization in a separate `@user.update(org_id: ...)` call. With department membership now validated against the user's organization, a request that changed the organization and department together was rejected: the department was checked against the user's current organization, and the organization change was never applied. Assign `org_id` from the organization lookup before updating, so a single `@user.update` validates the organization and department together. The follow-up update call is removed. Reload `@departments` after the update. It was previously built before the update, so after an organization change the re-rendered form listed the previous organization's departments. After a failed update, `@user.org` holds the unsaved organization, so the dropdown now matches the form's selected organization.
Add a TODO to verify whether the new-organization save block is still needed. When org creation is allowed, org_from_params saves new organizations and identifiers before returning. When org creation is restricted, it returns an existing organization or nil. In either case, the controller's new-record fallback appears unreachable.
Refresh department options after successful and failed edits, preserve stored attributes on validation errors, and return HTTP 422 for invalid updates. Remove duplicate organization persistence now that selection-service coverage verifies organization and identifier creation.
fix(super_admin): update user org and department in a single save
aaronskiba
approved these changes
Nov 4, 2026
aaronskiba
left a comment
aaronskiba
left a comment
Contributor
There was a problem hiding this comment.
Looks good to me.
NOTE: At the moment, it shows that the Postgres action still running, but when I go to https://github.com/DMPRoadmap/roadmap/actions/runs/41859726642/job/126685229635?pr=3626 it shows that all tests have passed and the action completed successfully.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security and maintenance fixes for v6.0.1, with regression coverage and compatibility updates.
No database migration is required. Detailed security advisories and disclosure credits will be published separately after the release is available.