Skip to content

saasMode:true — cross-org RBAC denial on internal schema reads (DocuDesk 'Document Template') despite adminOverride:true #2094

Description

@rubenvdlinde

Third in the multitenancy series (#2084 empty-orX, #2089 Source lookup, #2093 schema object-source lookup — all merged). After those, external-register (DBAL) reads + filtering work under saasMode:true, but an internal-register object read now fails: DocuDesk report generation returns User 'admin' does not have permission to 'read' objects in schema 'Document Template'.

The template objects live in a different organisation than admin's active org; adminOverride:true is set but does not appear to grant the cross-org read on this path. So saasMode:true still isn't fully functional for a mixed-org dataset.

Repro: enable occ config:app:set openregister multitenancy --value='{"saasMode":true,"adminOverride":true}', POST /apps/docudesk/api/documents/generate with a template in another org → 403-style JSON error.

Questions for the fix: should adminOverride:true bypass org scoping for reads by an actual NC admin? Or is the template schema's org assignment the real issue (should config-owned schemas be org-agnostic)?

Dev instance runs saasMode:false (single-admin box, the known-working state); this issue tracks completing real SaaS multitenancy support.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions