fix: set default role (#7593)

* fix: set default role

* fix: bug

packages/plugins/@nocobase/plugin-acl/src/server/__tests__/role-user.test.ts

@@ -238,4 +238,21 @@ describe('role', () => {
     const response3 = await agent.resource('roles').check();
     expect(response3.statusCode).toEqual(200);
   });
+
+  it('should not allow to set other role', async () => {
+    const user = await db.getRepository('users').create({
+      values: {},
+    });
+    const client = await api.agent().login(user);
+    await client.post('/users:setDefaultRole').send({
+      roleName: 'root',
+    });
+    const role = await db.getRepository('rolesUsers').findOne({
+      where: {
+        userId: user.get('id'),
+        roleName: 'root',
+      },
+    });
+    expect(role).toBeFalsy();
+  });
 });

packages/plugins/@nocobase/plugin-acl/src/server/actions/user-setDefaultRole.ts

@@ -8,6 +8,8 @@
  */
 
 import { Context, Next } from '@nocobase/actions';
+import { UNION_ROLE_KEY } from '../constants';
+import { Model } from '@nocobase/database';
 
 export async function setDefaultRole(ctx: Context, next: Next) {
   const {
@@ -55,11 +57,11 @@ export async function setDefaultRole(ctx: Context, next: Next) {
       },
       transaction,
     });
-    let model;
+    let model: Model;
     if (targetUserRole) {
       await repository.model.update({ default: true }, { where: { userId: currentUser.id, roleName }, transaction });
       model = targetUserRole.set('default', true);
-    } else {
+    } else if (roleName === UNION_ROLE_KEY) {
       model = await repository.create({
         values: {
           userId: currentUser.id,
@@ -69,7 +71,9 @@ export async function setDefaultRole(ctx: Context, next: Next) {
         transaction,
       });
     }
-    db.emitAsync('rolesUsers.afterSave', model);
+    if (model) {
+      db.emitAsync('rolesUsers.afterSave', model);
+    }
   });
 
   ctx.body = 'ok';