From def00fc8719ef44da33359ac0391842ee6acdb87 Mon Sep 17 00:00:00 2001
From: Qiu Jian <qiujian@yunionyun.com>
Date: Wed, 17 May 2023 23:33:29 +0800
Subject: [PATCH] fix: disable policy update when enable three member system

---
 pkg/keystone/models/policies.go | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/pkg/keystone/models/policies.go b/pkg/keystone/models/policies.go
index 829508cacc..9ce7228e69 100644
--- a/pkg/keystone/models/policies.go
+++ b/pkg/keystone/models/policies.go
@@ -687,12 +687,14 @@ func (policy *SPolicy) ValidateUpdateCondition(ctx context.Context) error {
 	//if policy.IsSystem.IsTrue() {
 	//	return errors.Wrap(httperrors.ErrForbidden, "system policy")
 	//}
-	rps, err := RolePolicyManager.fetchByPolicyId(policy.Id)
-	if err != nil {
-		return errors.Wrap(err, "fetchByPolicyId")
-	}
-	if len(rps) > 0 {
-		return errors.Wrap(httperrors.ErrForbidden, "policy in use")
+	if options.Options.ThreeAdminRoleSystem {
+		rps, err := RolePolicyManager.fetchByPolicyId(policy.Id)
+		if err != nil {
+			return errors.Wrap(err, "fetchByPolicyId")
+		}
+		if len(rps) > 0 {
+			return errors.Wrap(httperrors.ErrForbidden, "policy in use")
+		}
 	}
 	return nil
 }