9460: Name and Type Filters Narrow But Never Widen Visible Subjects

Scenario #9460: Name and Type Filters Narrow But Never Widen Visible Subjects

This scenario verifies that the optional name and type filters only narrow the otherwise-visible subjects and can never make additional subjects visible. The acting user has a rich visible set: subjects of its own realm and the groups of another organization in which its natural person also holds a user account.

Properties

Required

Account: xyz-peter.smith from 9310: Create Account and User Subject From Given Subject Uuid and Name

Given

name	value
thePersonsFamilyName	Smith
thePersonsGivenName	Peter
nameOfSamePersonGroupFromAnotherOrg	/def-Team
theAccountSubjectName	def-peter.smith
nameFilterPrefix	/xyz

Expected

name	value
expectedSubjectNamesWithTypeFilter	[ { “name”: “/xyz-Service” }, { “name”: “/xyz-Team” }, { “name”: “/def-Team” } ]
unexpectedSubjectNamesWithTypeFilter	[ { “name”: “xyz-peter.smith” } ]
expectedSubjectNamesWithNameFilter	[ { “name”: “/xyz-Service” }, { “name”: “/xyz-Team” } ]
unexpectedSubjectNamesWithNameFilter	[ { “name”: “xyz-peter.smith” }, { “name”: “/def-Team” } ]

Create group subject /def-Team

HTTP POST "/api/rbac/subjects" \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "sub" : "uuid<hsh-alex_superuser>"` \
  `# }` \
  -H 'Content-Type: application/json' \
  --data-binary @- <<EOF
{
  "name" : "/def-Team",
  "type" : "GROUP"
}
EOF
=> status: 201 CREATED d10a98a6-f7a9-41ca-b17e-91d1da23395d

Person: Peter Smith

HTTP GET "/api/hs/office/persons?name=Smith&type=NATURAL_PERSON" \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "sub" : "uuid<hsh-alex_superuser>"` \
  `# }`
=> status: 200 OK 
[ {
  "uuid" : "bfecf1fc-b92b-47ae-aa84-9d52b57457ef", // Person: Peter Smith
  "personType" : "NATURAL_PERSON",
  "tradeName" : null,
  "salutation" : null,
  "title" : null,
  "givenName" : "Peter",
  "familyName" : "Smith"
} ]

In production, this lookup would need a more precise selector.

Create same-person account def-peter.smith

HTTP POST "/api/hs/accounts/accounts" \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "sub" : "uuid<hsh-alex_superuser>"` \
  `# }` \
  -H 'Content-Type: application/json' \
  --data-binary @- <<EOF
{
  "person.uuid" : "bfecf1fc-b92b-47ae-aa84-9d52b57457ef", // Person: Peter Smith
  "subject" : {
    "uuid" : "242a0006-0000-0000-0000-000000000006",
    "name" : "def-peter.smith"
  },
  "globalUid" : 21014,
  "globalGid" : 21014
}
EOF
=> status: 201 CREATED 242a0006-0000-0000-0000-000000000006

Fetch all visible RBAC subjects without a filter

HTTP GET "/api/rbac/subjects" \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "comment" : "a user with same-realm subjects and a same-person account in another org",` \
  `#   "sub" : "uuid<xyz-peter.smith>"` \
  `# }`
=> status: 200 OK 
[ {
  "uuid" : "05cd4947-fa73-4b7f-af65-3ed95e4d618c",
  "name" : "/abc-Team",
  "type" : "GROUP"
}, {
  "uuid" : "d10a98a6-f7a9-41ca-b17e-91d1da23395d",
  "name" : "/def-Team",
  "type" : "GROUP"
}, {
  "uuid" : "242a0001-0000-0000-0000-000000000001", // theAccount
  "name" : "xyz-jack.tucker",
  "type" : "USER"
}, {
  "uuid" : "242a0003-0000-0000-0000-000000000003", // Account: xyz-peter.newman
  "name" : "xyz-peter.newman",
  "type" : "USER"
}, {
  "uuid" : "242a0002-0000-0000-0000-000000000002", // Account: xyz-peter.smith
  "name" : "xyz-peter.smith",
  "type" : "USER"
}, {
  "uuid" : "0c6b921a-0ba0-59a6-98d5-26b8727f274b",
  "name" : "/xyz-Service",
  "type" : "GROUP"
}, {
  "uuid" : "a366695d-3abc-5197-82ff-31090bd8c314",
  "name" : "/xyz-Team",
  "type" : "GROUP"
}, {
  "uuid" : "242a0004-0000-0000-0000-000000000004", // Account: xyz-tom.sawyer
  "name" : "xyz-tom.sawyer",
  "type" : "USER"
} ]

Fetch visible RBAC subjects narrowed by the name filter

HTTP GET "/api/rbac/subjects?name=/xyz" \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "comment" : "a user with same-realm subjects and a same-person account in another org",` \
  `#   "sub" : "uuid<xyz-peter.smith>"` \
  `# }`
=> status: 200 OK 
[ {
  "uuid" : "0c6b921a-0ba0-59a6-98d5-26b8727f274b",
  "name" : "/xyz-Service",
  "type" : "GROUP"
}, {
  "uuid" : "a366695d-3abc-5197-82ff-31090bd8c314",
  "name" : "/xyz-Team",
  "type" : "GROUP"
} ]

Fetch visible RBAC subjects narrowed by the type filter

HTTP GET "/api/rbac/subjects?type=GROUP" \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "comment" : "a user with same-realm subjects and a same-person account in another org",` \
  `#   "sub" : "uuid<xyz-peter.smith>"` \
  `# }`
=> status: 200 OK 
[ {
  "uuid" : "05cd4947-fa73-4b7f-af65-3ed95e4d618c",
  "name" : "/abc-Team",
  "type" : "GROUP"
}, {
  "uuid" : "d10a98a6-f7a9-41ca-b17e-91d1da23395d",
  "name" : "/def-Team",
  "type" : "GROUP"
}, {
  "uuid" : "0c6b921a-0ba0-59a6-98d5-26b8727f274b",
  "name" : "/xyz-Service",
  "type" : "GROUP"
}, {
  "uuid" : "a366695d-3abc-5197-82ff-31090bd8c314",
  "name" : "/xyz-Team",
  "type" : "GROUP"
} ]

Fetch all visible RBAC subjects without a filter

HTTP GET "/api/rbac/subjects" \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "comment" : "a user with same-realm subjects and a same-person account in another org",` \
  `#   "sub" : "uuid<xyz-peter.smith>"` \
  `# }`
=> status: 200 OK 
[ {
  "uuid" : "05cd4947-fa73-4b7f-af65-3ed95e4d618c",
  "name" : "/abc-Team",
  "type" : "GROUP"
}, {
  "uuid" : "d10a98a6-f7a9-41ca-b17e-91d1da23395d",
  "name" : "/def-Team",
  "type" : "GROUP"
}, {
  "uuid" : "242a0001-0000-0000-0000-000000000001", // theAccount
  "name" : "xyz-jack.tucker",
  "type" : "USER"
}, {
  "uuid" : "242a0003-0000-0000-0000-000000000003", // Account: xyz-peter.newman
  "name" : "xyz-peter.newman",
  "type" : "USER"
}, {
  "uuid" : "242a0002-0000-0000-0000-000000000002", // Account: xyz-peter.smith
  "name" : "xyz-peter.smith",
  "type" : "USER"
}, {
  "uuid" : "0c6b921a-0ba0-59a6-98d5-26b8727f274b",
  "name" : "/xyz-Service",
  "type" : "GROUP"
}, {
  "uuid" : "a366695d-3abc-5197-82ff-31090bd8c314",
  "name" : "/xyz-Team",
  "type" : "GROUP"
}, {
  "uuid" : "242a0004-0000-0000-0000-000000000004", // Account: xyz-tom.sawyer
  "name" : "xyz-tom.sawyer",
  "type" : "USER"
} ]

Fetch visible RBAC subjects narrowed by the name filter

HTTP GET "/api/rbac/subjects?name=/xyz" \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "comment" : "a user with same-realm subjects and a same-person account in another org",` \
  `#   "sub" : "uuid<xyz-peter.smith>"` \
  `# }`
=> status: 200 OK 
[ {
  "uuid" : "0c6b921a-0ba0-59a6-98d5-26b8727f274b",
  "name" : "/xyz-Service",
  "type" : "GROUP"
}, {
  "uuid" : "a366695d-3abc-5197-82ff-31090bd8c314",
  "name" : "/xyz-Team",
  "type" : "GROUP"
} ]

generated on 2026-07-17 01:42:21 for branch