fix(core): disable bring your ui feature for admin tenant (#6300)

logto-io · Jul 23, 2024 · 27e0d36 · 27e0d36
1 parent 3cb3e5f
commit 27e0d36
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 4 deletions.
diff --git a/packages/core/src/routes/sign-in-experience/custom-ui-assets/index.ts b/packages/core/src/routes/sign-in-experience/custom-ui-assets/index.ts
@@ -1,6 +1,6 @@
 import { readFile } from 'node:fs/promises';
 
-import { uploadFileGuard, maxUploadFileSize } from '@logto/schemas';
+import { uploadFileGuard, maxUploadFileSize, adminTenantId } from '@logto/schemas';
 import { generateStandardId } from '@logto/shared';
 import pRetry, { AbortError } from 'p-retry';
 import { object, z } from 'zod';
@@ -53,6 +53,10 @@ export default function customUiAssetsRoutes<T extends ManagementApiRouter>(
       assertThat(file.size <= maxUploadFileSize, 'guard.file_size_exceeded');
       assertThat(file.mimetype === 'application/zip', 'guard.mime_type_not_allowed');
 
+      const [tenantId] = await getTenantId(ctx.URL);
+      assertThat(tenantId, 'guard.can_not_get_tenant_id');
+      assertThat(tenantId !== adminTenantId, 'guard.not_allowed_for_admin_tenant');
+
       const { experienceZipsProviderConfig } = SystemContext.shared;
       assertThat(
         experienceZipsProviderConfig?.provider === 'AzureStorage',
@@ -65,9 +69,6 @@ export default function customUiAssetsRoutes<T extends ManagementApiRouter>(
         container
       );
 
-      const [tenantId] = await getTenantId(ctx.URL);
-      assertThat(tenantId, 'guard.can_not_get_tenant_id');
-
       const customUiAssetId = generateStandardId(8);
       const objectKey = `${tenantId}/${customUiAssetId}/assets.zip`;
       const errorLogObjectKey = `${tenantId}/${customUiAssetId}/error.log`;

diff --git a/packages/phrases/src/locales/en/errors/guard.ts b/packages/phrases/src/locales/en/errors/guard.ts
@@ -4,6 +4,7 @@ const guard = {
   can_not_get_tenant_id: 'Unable to get tenant id from request.',
   file_size_exceeded: 'File size exceeded.',
   mime_type_not_allowed: 'MIME type is not allowed.',
+  not_allowed_for_admin_tenant: 'Not allowed for admin tenant.',
 };
 
 export default Object.freeze(guard);