Multi-tenancy: impersonate has no effect inside a tenant (MT-1, MT-15)

The ceiling always disables impersonate for principals in a tenant, so no tenant setting or grant lets them reach accounts beyond it.
2026-09-18 18:51:42 -07:00
parent ac2232c98d
commit ec4d668bc4
2 changed files with 55 additions and 0 deletions
@@ -100,6 +100,8 @@ impl Server {
            },
        };
        ceiling(base, policy).apply(&mut permissions.enabled, &mut permissions.disabled);
+        // inbuxa: MT-1, MT-15: impersonation would reach beyond the tenant
+        permissions.disabled.set(Permission::Impersonate as usize);

        Ok(())
    }