From 4c17c824e0439cc75f576da71048516c98ab1cdc Mon Sep 17 00:00:00 2001 From: nvazquez Date: Fri, 14 Aug 2026 10:01:24 -0300 Subject: [PATCH 1/2] Invalidate cache also on updateRolePermission, importRole and updateAccount APIs --- server/src/main/java/com/cloud/user/AccountManagerImpl.java | 1 + .../main/java/org/apache/cloudstack/acl/RoleManagerImpl.java | 4 ++++ 2 files changed, 5 insertions(+) diff --git a/server/src/main/java/com/cloud/user/AccountManagerImpl.java b/server/src/main/java/com/cloud/user/AccountManagerImpl.java index b4c23beaef2e..bf3f22540825 100644 --- a/server/src/main/java/com/cloud/user/AccountManagerImpl.java +++ b/server/src/main/java/com/cloud/user/AccountManagerImpl.java @@ -2356,6 +2356,7 @@ public AccountVO updateAccount(UpdateAccountCmd cmd) { validateRoleChange(account, role, caller); acctForUpdate.setRoleId(roleId); acctForUpdate.setType(role.getRoleType().getAccountType()); + refreshRoleCheckersCacheOnPermissionsChange(role); checkRoleEscalation(getCurrentCallingAccount(), acctForUpdate); } diff --git a/server/src/main/java/org/apache/cloudstack/acl/RoleManagerImpl.java b/server/src/main/java/org/apache/cloudstack/acl/RoleManagerImpl.java index 4c7c86baeb78..c9c2342d02a5 100644 --- a/server/src/main/java/org/apache/cloudstack/acl/RoleManagerImpl.java +++ b/server/src/main/java/org/apache/cloudstack/acl/RoleManagerImpl.java @@ -262,6 +262,8 @@ public RoleVO doInTransaction(TransactionStatus status) { throw new CloudRuntimeException("Unable to import the role: " + name + ", failed to persist in DB"); } + accountManager.refreshRoleCheckersCacheOnPermissionsChange(newRole); + if (rules != null && !rules.isEmpty()) { for (Map ruleDetail : rules) { Rule rule = (Rule)ruleDetail.get(ApiConstants.RULE); @@ -410,6 +412,7 @@ public boolean updateRolePermission(final Role role, final List if (role.isDefault()) { throw new PermissionDeniedException("Role permission cannot be updated for Default roles"); } + accountManager.refreshRoleCheckersCacheOnPermissionsChange(role); return role != null && newOrder != null && rolePermissionsDao.update(role, newOrder); } @@ -419,6 +422,7 @@ public boolean updateRolePermission(Role role, RolePermission rolePermission, Pe if (role.isDefault()) { throw new PermissionDeniedException("Role permission cannot be updated for Default roles"); } + accountManager.refreshRoleCheckersCacheOnPermissionsChange(role); return role != null && rolePermissionsDao.update(role, rolePermission, permission); } From 476d43ee558cb84bf0c03cb834309389b49a72a3 Mon Sep 17 00:00:00 2001 From: nvazquez Date: Fri, 14 Aug 2026 14:11:56 -0300 Subject: [PATCH 2/2] Fix update account --- server/src/main/java/com/cloud/user/AccountManagerImpl.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/server/src/main/java/com/cloud/user/AccountManagerImpl.java b/server/src/main/java/com/cloud/user/AccountManagerImpl.java index bf3f22540825..3ea0c69bfbff 100644 --- a/server/src/main/java/com/cloud/user/AccountManagerImpl.java +++ b/server/src/main/java/com/cloud/user/AccountManagerImpl.java @@ -2356,8 +2356,8 @@ public AccountVO updateAccount(UpdateAccountCmd cmd) { validateRoleChange(account, role, caller); acctForUpdate.setRoleId(roleId); acctForUpdate.setType(role.getRoleType().getAccountType()); - refreshRoleCheckersCacheOnPermissionsChange(role); checkRoleEscalation(getCurrentCallingAccount(), acctForUpdate); + refreshRoleCheckersCacheOnPermissionsChange(role); } if (networkDomain != null) {