Control Center Access Control Logic Fix

Control Center Access Control Logic Fix

Version: 0.235.011
Fixed in: 0.235.011
Category: Access Control / Authorization

Issue Description

The Control Center access control logic had a discrepancy where:

1. When require_member_of_control_center_admin was disabled (the default), users with the ControlCenterAdmin role (but NOT the regular Admin role) were incorrectly granted access.

2. The intended behavior is that the ControlCenterAdmin role should ONLY be checked when that role feature is enabled. When disabled, only the regular Admin role should grant access.

Root Cause

The control_center_required decorator in functions_authentication.py was checking for ControlCenterAdmin role unconditionally, allowing access regardless of whether the role feature was enabled or not.

Expected Behavior

When require_member_of_control_center_admin is DISABLED (default):

When require_member_of_control_center_admin is ENABLED:

Key Insight

The setting require_member_of_control_center_admin acts as a switch between two access control modes:

• OFF (default): Use Admin role for access control
• ON: Use ControlCenterAdmin role for access control

The ControlCenterAdmin role is only relevant when the setting is enabled. Otherwise, it's ignored.

Files Modified

1. functions_authentication.py

• Updated control_center_required decorator to:
  • Check for both ControlCenterAdmin and regular Admin roles
  • Properly fall back to Admin role when ControlCenterAdmin requirement is disabled
  • Deny access to non-admin users with appropriate error messages
  • Comprehensive docstring explaining both access modes

2. route_frontend_control_center.py

• Updated the control_center() route to:
  • Compute has_full_admin_access based on user roles AND settings
  • Pass the correct value to the template for conditional tab rendering

3. config.py

• Version updated to 0.235.011

Code Changes Summary

Decorator Logic (functions_authentication.py)

# New logic flow:
# 1. Check if ControlCenterAdmin requirement is ENABLED
#    - If ENABLED: Only ControlCenterAdmin role grants access
#    - Regular Admin role is NOT sufficient
# 2. If ControlCenterAdmin requirement is DISABLED:
#    - Only regular Admin role grants access
#    - ControlCenterAdmin role is IGNORED (feature not enabled)
#    - DashboardReader gets dashboard-only (if that setting enabled)
# 3. Non-admin users are denied with appropriate message

Frontend Route Logic (route_frontend_control_center.py)

# Compute has_full_admin_access based on which mode is active:
if require_member_of_control_center_admin:
    # ControlCenterAdmin role is required
    has_full_admin_access = has_control_center_admin_role
else:
    # Only regular Admin role grants access
    has_full_admin_access = has_regular_admin_role

Testing

Functional test created: functional_tests/test_control_center_access_logic.py

The test validates:

1. Decorator checks for regular Admin role
2. Decorator checks for ControlCenterAdmin role
3. ControlCenterAdmin gets access when setting is enabled
4. ControlCenterAdmin is ignored when setting is disabled
5. Regular Admin gets access when requirement is disabled
6. Non-admin users are denied access
7. Comprehensive docstring exists

Validation Steps

1. Test as Admin (CC admin requirement DISABLED):

   • User with Admin role should see all Control Center tabs

2. Test as ControlCenterAdmin ONLY (CC admin requirement DISABLED):

   • User with only ControlCenterAdmin role should be DENIED access

3. Test as Admin (CC admin requirement ENABLED):

   • User with only Admin role should be DENIED access

4. Test as ControlCenterAdmin (CC admin requirement ENABLED):

   • User with ControlCenterAdmin role should have full access

5. Test as DashboardReader:

   • Should see only Dashboard tab when that requirement is enabled

Related Settings