Filter roles when querying role service

LayerManager · Dec 5, 2023 · 517e4f8 · 517e4f8
1 parent c030a22
commit 517e4f8
Showing 1 changed file with 8 additions and 2 deletions.
diff --git a/src/layman/authz/role_service.py b/src/layman/authz/role_service.py
@@ -25,6 +25,12 @@ def ensure_admin_roles():
 
 
 def get_user_roles(username):
-    query = f"""select rolename from {ROLE_SERVICE_SCHEMA}.user_roles where username = %s"""
-    roles = db_util.run_query(query, (username, ))
+    query = f"""
+select rolename from {ROLE_SERVICE_SCHEMA}.user_roles
+where username = %s
+  and rolename not in (%s, %s, %s)
+  and LEFT(rolename, 5) != 'USER_'
+  and rolename ~ %s
+"""
+    roles = db_util.run_query(query, (username, 'ADMIN', 'GROUP_ADMIN', settings.LAYMAN_GS_ROLE, ''))
     return {role[0] for role in roles}