Fix permission checking on srv remove
@@ -174,7 +174,16 @@ impl ParticleAppServices {
get_service(&services_read, &self.aliases.read(), service_id_or_alias)
.map_err(ServiceError::NoSuchService)?;
- if service.owner_id != init_peer_id && self.builtins_management_peer_id != init_peer_id
+ /// What a mess.
+ /// service.owner_id has created the service, so can remove. only naturel.
+ /// management_peer_id is the node admin, can remove any service.
+ /// builtins_management_peer_id is a HACKity hack:
+ /// It needs to be able to remove only builtins (services deployed from FS on start),
+ /// but there's no way to tell which one's are "builtins", so we allow it to remove
+ /// all services.
+ if service.owner_id != init_peer_id
+ && self.management_peer_id != init_peer_id
+ && self.builtins_management_peer_id != init_peer_id
{
return Err(ServiceError::Forbidden {
user: init_peer_id,
