SECURITY - МЕЖПРОЕКТНАЯ КОММУНИКАЦИЯ: ограничение создания проектов

plane-src/apps/api/plane/authentication/views/nodedc_workspace_adapter.py

@@ -9,6 +9,10 @@ from django.utils.decorators import method_decorator
 from django.views import View
 from django.views.decorators.csrf import csrf_exempt
 
+from plane.authentication.nodedc_project_memberships import (
+    ensure_user_admin_project_memberships,
+    revoke_auto_project_admin_memberships,
+)
 from plane.authentication.views.nodedc_logout import is_internal_logout_request_authorized
 from plane.app.realtime.issue_events import publish_assignee_cleanup_issue_events_on_commit
 from plane.app.realtime.nodedc_events import (
@@ -332,24 +336,7 @@ def serialize_project_membership(project_member, created):
 
 
 def restore_admin_project_memberships(workspace, user):
-    restored = 0
-    for project_member in ProjectMember.objects.filter(
-        project__workspace=workspace,
-        member=user,
-        deleted_at__isnull=True,
-    ):
-        update_fields = []
-        if project_member.role != ADMIN_ROLE:
-            project_member.role = ADMIN_ROLE
-            update_fields.append("role")
-        if not project_member.is_active:
-            project_member.is_active = True
-            update_fields.append("is_active")
-        if update_fields:
-            update_fields.append("updated_at")
-            project_member.save(update_fields=update_fields)
-            restored += 1
-    return restored
+    return ensure_user_admin_project_memberships(workspace, user)
 
 
 @method_decorator(csrf_exempt, name="dispatch")
@@ -441,6 +428,7 @@ class NodeDCInternalWorkspaceMembershipEnsureEndpoint(View):
                 deleted_at__isnull=True,
             ).first()
             created = membership is None
+            previous_role = membership.role if membership is not None else None
 
             if membership is None:
                 membership = WorkspaceMember.objects.create(
@@ -463,6 +451,8 @@ class NodeDCInternalWorkspaceMembershipEnsureEndpoint(View):
 
             if role == ADMIN_ROLE:
                 restore_admin_project_memberships(workspace, user)
+            elif previous_role == ADMIN_ROLE:
+                revoke_auto_project_admin_memberships(workspace, user)
 
             if set_last_workspace:
                 profile, _ = Profile.objects.get_or_create(user=user)