Allow deployment-level exemptions from ADMIN_ONLY_PROJECT_ADD by project type - #2807
Open
Kaveh-Vakili wants to merge 7 commits into
Open
Allow deployment-level exemptions from ADMIN_ONLY_PROJECT_ADD by project type#2807Kaveh-Vakili wants to merge 7 commits into
Kaveh-Vakili wants to merge 7 commits into
Conversation
…ect type Adds ADMIN_ONLY_PROJECT_ADD_EXEMPT_TYPES, a comma-separated allowlist of project types (e.g. WORKSPACE,SKILL) that stay creatable by non-admins even when ADMIN_ONLY_PROJECT_ADD is enabled, so deployments can lock down code apps while still letting users build workspaces/skills. Empty/unset preserves today's all-or-nothing behavior. Enforcement is centralized in ProjectHelper.generateNewProject, which covers every standard creation reactor. The two zip-upload reactors (UploadProjectReactor, UploadProjectAppReactor) needed special handling since the project type lives inside the uploaded zip: both now peek the .smss entry directly out of the zip (no disk writes) to learn the type and enforce the check before any temp files are created, so a rejected upload never requires cleanup.
Contributor
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
kunal0137
marked this pull request as ready for review
August 6, 2026 01:18
Collaborator
|
to be merged together: |
This was referenced Aug 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Currently, ADMIN_ONLY_PROJECT_ADD is all-or-nothing — when enabled, only platform admins can create any new app, regardless of type. This adds a deployment-level allowlist so specific app types (e.g. WORKSPACE, SKILL) can stay open to all users even while ADMIN_ONLY_PROJECT_ADD is enabled, letting deployments lock down code apps specifically without blocking everything.
Changes Made
Added ADMIN_ONLY_PROJECT_ADD_EXEMPT_TYPES — a new comma-separated deployment setting listing project types exempt from ADMIN_ONLY_PROJECT_ADD (e.g. WORKSPACE,SKILL). Empty/unset preserves current all-or-nothing behavior.
Constants.java — new constant for the setting.
Utility.java — new getter that parses the CSV into a Set<IProject.PROJECT_TYPE>, ignoring unrecognized values.
AbstractSecurityUtils.java — caches the exempt-types set at startup/refresh and exposes isProjectAddExemptFromAdminOnly(type).
ProjectHelper.java — generateNewProject's admin-only check now also allows the request through if the project's type is in the exempt list. This single change covers every standard creation reactor (CreateProject, AddWorkspace, CreateSkill, CloneSkill, CreateAppFromBlocks, CreateAppFromTemplate), since they all route through this method.
UploadProjectReactor.java / UploadProjectAppReactor.java — these two don't go through generateNewProject, and the project type lives inside the uploaded zip rather than being known up front. Both now peek the .smss entry directly out of the zip (via java.util.zip.ZipFile, no disk writes) to learn the type and enforce the check before unzipping anything — so a rejected upload never creates temp files that need cleanup.
How to Test
Set ADMIN_ONLY_PROJECT_ADD=true and ADMIN_ONLY_PROJECT_ADD_EXEMPT_TYPES=WORKSPACE,SKILL locally, restart the server, and log in as a non-admin user.
Run CreateProject(project=["Test"], projectType=["CODE"]) — expect rejection: operationType: ["ERROR"], output "This functionality is limited to only admins".
Run AddWorkspace(name=["Test Workspace"]) and/or CreateSkill(...) as the same non-admin user — expect these to succeed normally (operationType: ["MARKET_PLACE_ADDITION"]), since WORKSPACE/SKILL are exempt.
Log in as an admin and repeat step 2 — expect it to succeed (admins always bypass this check).
Upload a zip backup of a CODE-type project as the non-admin user — expect rejection, and confirm no leftover temp/unzip folder is left on disk.
Upload a zip backup of an exempt-type (WORKSPACE/SKILL) project as the non-admin user — expect it to succeed.
Unset ADMIN_ONLY_PROJECT_ADD_EXEMPT_TYPES entirely and repeat step 2/3 — expect everything to be rejected again, confirming default behavior is unchanged from today.
Notes