From e89266c08d8e9e140ad39fb1f6d6a3bc74b5e1a0 Mon Sep 17 00:00:00 2001
From: YANG QIA <2013xile@gmail.com>
Date: Tue, 14 Oct 2025 23:09:45 +0800
Subject: [PATCH] fix: set default role (#7593)

* fix: set default role

* fix: bug
---
 .../src/server/__tests__/role-user.test.ts      | 17 +++++++++++++++++
 .../src/server/actions/user-setDefaultRole.ts   | 10 +++++++---
 2 files changed, 24 insertions(+), 3 deletions(-)

diff --git a/packages/plugins/@nocobase/plugin-acl/src/server/__tests__/role-user.test.ts b/packages/plugins/@nocobase/plugin-acl/src/server/__tests__/role-user.test.ts
index 4c2a29b8ee9..9f3287e0111 100644
--- a/packages/plugins/@nocobase/plugin-acl/src/server/__tests__/role-user.test.ts
+++ b/packages/plugins/@nocobase/plugin-acl/src/server/__tests__/role-user.test.ts
@@ -238,4 +238,21 @@ describe('role', () => {
     const response3 = await agent.resource('roles').check();
     expect(response3.statusCode).toEqual(200);
   });
+
+  it('should not allow to set other role', async () => {
+    const user = await db.getRepository('users').create({
+      values: {},
+    });
+    const client = await api.agent().login(user);
+    await client.post('/users:setDefaultRole').send({
+      roleName: 'root',
+    });
+    const role = await db.getRepository('rolesUsers').findOne({
+      where: {
+        userId: user.get('id'),
+        roleName: 'root',
+      },
+    });
+    expect(role).toBeFalsy();
+  });
 });
diff --git a/packages/plugins/@nocobase/plugin-acl/src/server/actions/user-setDefaultRole.ts b/packages/plugins/@nocobase/plugin-acl/src/server/actions/user-setDefaultRole.ts
index 093f3f7fc29..0b884b09abb 100644
--- a/packages/plugins/@nocobase/plugin-acl/src/server/actions/user-setDefaultRole.ts
+++ b/packages/plugins/@nocobase/plugin-acl/src/server/actions/user-setDefaultRole.ts
@@ -8,6 +8,8 @@
  */
 
 import { Context, Next } from '@nocobase/actions';
+import { UNION_ROLE_KEY } from '../constants';
+import { Model } from '@nocobase/database';
 
 export async function setDefaultRole(ctx: Context, next: Next) {
   const {
@@ -55,11 +57,11 @@ export async function setDefaultRole(ctx: Context, next: Next) {
       },
       transaction,
     });
-    let model;
+    let model: Model;
     if (targetUserRole) {
       await repository.model.update({ default: true }, { where: { userId: currentUser.id, roleName }, transaction });
       model = targetUserRole.set('default', true);
-    } else {
+    } else if (roleName === UNION_ROLE_KEY) {
       model = await repository.create({
         values: {
           userId: currentUser.id,
@@ -69,7 +71,9 @@ export async function setDefaultRole(ctx: Context, next: Next) {
         transaction,
       });
     }
-    db.emitAsync('rolesUsers.afterSave', model);
+    if (model) {
+      db.emitAsync('rolesUsers.afterSave', model);
+    }
   });
 
   ctx.body = 'ok';