chore: restrict on RBAC middleware (#9000)

Unleash · Dec 19, 2024 · 3468161 · 3468161
1 parent de5f9be
commit 3468161
Showing 1 changed file with 19 additions and 1 deletion.
diff --git a/src/lib/middleware/rbac-middleware.ts b/src/lib/middleware/rbac-middleware.ts
@@ -33,7 +33,7 @@ export function findParam(
 }
 
 const rbacMiddleware = (
-    config: Pick<IUnleashConfig, 'getLogger'>,
+    config: Pick<IUnleashConfig, 'getLogger' | 'isOss'>,
     {
         featureToggleStore,
         segmentStore,
@@ -98,6 +98,24 @@ const rbacMiddleware = (
             ) {
                 projectId = 'default';
             }
+            if (config.isOss) {
+                if (projectId !== undefined && projectId !== 'default') {
+                    logger.error(
+                        'OSS is only allowed to work with default project.',
+                    );
+                    return false;
+                }
+                const ossEnvs = ['default', 'development', 'production'];
+                if (
+                    environment !== undefined &&
+                    !ossEnvs.includes(environment)
+                ) {
+                    logger.error(
+                        `OSS is only allowed to work with ${ossEnvs} environments.`,
+                    );
+                    return false;
+                }
+            }
 
             // DELETE segment does not include information about the segment's project
             // This is needed to check if the user has the right permissions on a project level