Repository navigation
permissions: PUT /api/permissions/roles/{id} with missing 'permissions' field silently wipes all role permissions #269
Description
Found by QA (browser fetch against a live app, reproduced): PUT /api/permissions/roles/{id} with body {} returns 200 and deletes every permission assigned to the role.
Root cause: RolePermissionsUpdate.permissions uses default_factory=list (modules/permissions/permissions/contracts/schemas.py), so a body that omits the field validates as an explicit empty list, and PermissionService.set_role_permissions treats the list as the full desired state — deleting all rows not in it.
Impact: an admin (or any client with permissions.manage) sending a malformed body can silently strip a role — including locking the admin role out of the role editor itself. Suggested fix: make permissions required in the update schema (explicit [] stays legal as a deliberate clear-all), so a missing field 422s instead of wiping.
Pre-existing on main (not related to PR #267); found during its QA cycle.
Activity
antosubash commentedon Aug 21, 2026
🤖 Claimed. I am creating an isolated worktree from
origin/mainand starting implementation.antosubash commentedon Aug 21, 2026
✅ Draft pull request opened: #277
Implementation
RolePermissionsUpdate.permissionsrequired.permissionsnow returns HTTP 422 without changing assignments.{"permissions": []}remains a valid clear-all operation.Changed areas
modules/permissions/permissions/contracts/schemas.pymodules/permissions/tests/test_permissions_module.pyVerification
uv run pytest modules/permissions/tests— 29 passeduv run ty check ...— passedgit diff --check— passedVisual evidence: none required.
Risks/blockers: none.
fix: address review feedback for #269
fix: permissions: PUT /api/permissions/roles/{id} with missing 'permi…