Skip to content

add: reject rdn modify#933

Open
iyashnov wants to merge 6 commits intodevfrom
refactor_reject_rdn_modify
Open

add: reject rdn modify#933
iyashnov wants to merge 6 commits intodevfrom
refactor_reject_rdn_modify

Conversation

@iyashnov
Copy link
Collaborator

@iyashnov iyashnov commented Feb 11, 2026

Задача: 1040

Теперь перед непосредственной обработкой modify запроса происходит проверка на изменение RDN. Если RDN пытаются изменить, то весь запрос реджектится, возвращается код 67(NOT ALLOWED ON RDN)

Сделано:

  • Проверка изменения RDN
  • Добавлен тест для проверки корректности
  • Удален тест, в котором происходила модификация RDN

Copilot AI review requested due to automatic review settings February 11, 2026 06:58
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR introduces server-side rejection of LDAP modify requests that attempt to change an entry’s RDN attribute, returning LDAP result code 67 (NOT_ALLOWED_ON_RDN).

Changes:

  • Added an early check in ModifyRequest.handle() to reject modifies that include the entry’s rdname attribute.
  • Added an LDAP CLI (ldapmodify) test that asserts RDN modification is rejected with code 67.
  • Removed an API test that previously performed an RDN (cn) modification.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File Description
app/ldap_protocol/ldap_requests/modify.py Adds RDN-modification rejection to the modify request handler.
tests/test_ldap/test_util/test_modify.py Adds a new ldapmodify-based test for NOT_ALLOWED_ON_RDN.
tests/test_api/test_main/test_router/test_modify.py Removes an API test that modified cn (RDN) via /entry/update.
Comments suppressed due to low confidence (1)

tests/test_api/test_main/test_router/test_modify.py:295

  • This PR removes an API-level test that exercised replacing the RDN attribute (cn). Since the new behavior is to reject such modifies with NOT_ALLOWED_ON_RDN (67), it would be good to add/adjust an API test to assert the new result code for /entry/update when attempting to modify the entry’s RDN attribute. Currently the new behavior is only covered via ldapmodify CLI tests, leaving the API route untested for this regression.
@pytest.mark.asyncio
@pytest.mark.usefixtures("adding_test_user")
@pytest.mark.usefixtures("setup_session")
@pytest.mark.usefixtures("session")
async def test_api_modify_many(http_client: AsyncClient) -> None:

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@iyashnov iyashnov force-pushed the refactor_reject_rdn_modify branch from e384c74 to a71fe2e Compare February 13, 2026 10:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants