graasp / graasp-builder

Web client for the Graasp Platform
https://builder.graasp.org
GNU Affero General Public License v3.0
5 stars 6 forks source link

Prevent downgrade permission more than parent's #1403

Open pyphilia opened 2 months ago

pyphilia commented 2 months ago

In membership table, we can change the access permission of a member on this item B in parent A. Let's say we have memberships: imA.permission = write and imB = admin for a member, updating imB shouldn't be less than write.

It's not possible to prevent this behavior in the frontend (unless we specifically fetch parent's memberships) since the received memberships are "squashed" (eg. we receive only imB because it's higher than imA).