server,ui: prevent role change for default accounts #11761

shwstppr · 2025-09-30T06:28:22Z

Description

Role for default accounts shouldn't be changed. Appropriate error should be returned by the server and UI should not present option for them.

Types of changes

Breaking change (fix or feature that would cause existing functionality to change)
New feature (non-breaking change which adds functionality)
Bug fix (non-breaking change which fixes an issue)
Enhancement (improves an existing feature and functionality)
Cleanup (Code refactoring and cleanup, that may add test cases)
Build/CI
Test (unit or integration test code)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Major
Minor

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

How did you try to break this feature and the system with this change?

Fixes apache#10931 Role for default accounts shouldn't be changed. Appropriate error should be returned by the server and UI should not present option for them. Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

codecov · 2025-09-30T06:36:38Z

Codecov Report

❌ Patch coverage is 50.00000% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 16.17%. Comparing base (5dfeb79) to head (56d80af).
⚠️ Report is 48 commits behind head on 4.20.

Files with missing lines	Patch %	Lines
...c/main/java/com/cloud/user/AccountManagerImpl.java	50.00%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff            @@
##               4.20   #11761   +/-   ##
=========================================
  Coverage     16.17%   16.17%           
- Complexity    13296    13299    +3     
=========================================
  Files          5656     5656           
  Lines        498223   498248   +25     
  Branches      60454    60460    +6     
=========================================
+ Hits          80577    80588   +11     
- Misses       408676   408688   +12     
- Partials       8970     8972    +2

Flag	Coverage Δ
uitests	`4.00% <ø> (-0.01%)`	⬇️
unittests	`17.02% <50.00%> (+<0.01%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

shwstppr · 2025-09-30T07:02:50Z

@blueorangutan package

blueorangutan · 2025-09-30T07:04:04Z

@shwstppr a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2025-09-30T08:50:35Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 15231

Copilot

Pull Request Overview

This PR prevents role changes for default accounts by adding server-side validation and UI restrictions. When users attempt to modify roles for default accounts, the server returns an appropriate error message and the UI hides the role selection option.

Added server-side validation to prevent role changes for default accounts
Modified UI to conditionally hide role selection for default accounts
Added comprehensive test coverage for the new validation logic

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
ui/src/views/iam/EditAccount.vue	Conditionally hides role form field for default accounts and safely handles roleid parameter
server/src/main/java/com/cloud/user/AccountManagerImpl.java	Adds validation to prevent role changes for default accounts with early return optimization
server/src/test/java/com/cloud/user/AccountManagerImplTest.java	Adds test case to verify default account role change restriction

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

server/src/main/java/com/cloud/user/AccountManagerImpl.java

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

shwstppr · 2025-10-01T08:40:26Z

@blueorangutan package

blueorangutan · 2025-10-01T08:42:04Z

@shwstppr a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2025-10-01T10:08:57Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 15250

DaanHoogland

clgtm and makes sense

pavanaravapalli

code LGTM

DaanHoogland · 2025-10-21T08:41:33Z

@blueorangutan test

blueorangutan · 2025-10-21T08:42:03Z

@DaanHoogland a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

blueorangutan · 2025-10-22T01:22:02Z

[SF] Trillian test result (tid-14707)
Environment: kvm-ol8 (x2), zone: Advanced Networking with Mgmt server ol8
Total time taken: 56701 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr11761-t14707-kvm-ol8.zip
Smoke tests completed. 141 look OK, 0 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test	Result	Time (s)	Test File

RosiKyu · 2025-12-10T16:50:18Z

@blueorangutan package

blueorangutan · 2025-12-10T16:52:04Z

@rosi-shapeblue a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2025-12-10T18:34:19Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 15981

RosiKyu

Verification passed. Fix is working as expected.

Default admin (isdefault=true) - role change is not allowed/available in UI
Non-default admins (isdefault=false) - role change is allowed
Tested via api as well: Role change silently ignored, admin remains Root Admin

* server,ui: prevent role change for default accounts Fixes apache#10931 Role for default accounts shouldn't be changed. Appropriate error should be returned by the server and UI should not present option for them. Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * Update server/src/main/java/com/cloud/user/AccountManagerImpl.java Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --------- Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

server,ui: prevent role change for default accounts

64bbd0e

Fixes apache#10931 Role for default accounts shouldn't be changed. Appropriate error should be returned by the server and UI should not present option for them. Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

boring-cyborg bot added the component:UI label Sep 30, 2025

shwstppr requested a review from Copilot October 1, 2025 07:26

Copilot AI reviewed Oct 1, 2025

View reviewed changes

server/src/main/java/com/cloud/user/AccountManagerImpl.java Outdated Show resolved Hide resolved

Update server/src/main/java/com/cloud/user/AccountManagerImpl.java

56d80af

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

DaanHoogland approved these changes Oct 3, 2025

View reviewed changes

shwstppr marked this pull request as ready for review October 15, 2025 02:55

pavanaravapalli approved these changes Oct 20, 2025

View reviewed changes

DaanHoogland added the component:api label Oct 31, 2025

DaanHoogland linked an issue Oct 31, 2025 that may be closed by this pull request

Default Admin user should not be allowed to change its ROLE type #10931

Closed

DaanHoogland added the status:needs-testing label Oct 31, 2025

DaanHoogland assigned RosiKyu Nov 11, 2025

RosiKyu added status:testing and removed status:needs-testing labels Dec 12, 2025

RosiKyu approved these changes Dec 12, 2025

View reviewed changes

RosiKyu added status:ready-for-merge and removed status:testing labels Dec 12, 2025

DaanHoogland merged commit e1c48c3 into apache:4.20 Dec 12, 2025
42 of 43 checks passed

DaanHoogland deleted the prevent-defaultadmin-rolechange branch December 12, 2025 12:42

server,ui: prevent role change for default accounts #11761

server,ui: prevent role change for default accounts #11761

Uh oh!

Conversation

shwstppr commented Sep 30, 2025

Description

Types of changes

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

How did you try to break this feature and the system with this change?

Uh oh!

codecov bot commented Sep 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

shwstppr commented Sep 30, 2025

Uh oh!

blueorangutan commented Sep 30, 2025

Uh oh!

blueorangutan commented Sep 30, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

shwstppr commented Oct 1, 2025

Uh oh!

blueorangutan commented Oct 1, 2025

Uh oh!

blueorangutan commented Oct 1, 2025

Uh oh!

DaanHoogland left a comment

Choose a reason for hiding this comment

Uh oh!

pavanaravapalli left a comment

Choose a reason for hiding this comment

Uh oh!

DaanHoogland commented Oct 21, 2025

Uh oh!

blueorangutan commented Oct 21, 2025

Uh oh!

blueorangutan commented Oct 22, 2025

Uh oh!

RosiKyu commented Dec 10, 2025

Uh oh!

blueorangutan commented Dec 10, 2025

Uh oh!

blueorangutan commented Dec 10, 2025

Uh oh!

RosiKyu left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

codecov bot commented Sep 30, 2025 •

edited

Loading

RosiKyu left a comment •

edited

Loading