[justin-prime1]

Description

Recalculate the ETAC all-environments flag when SAML/OIDC provisioning changes a user's role, using the same rules as account creation. Preserve manual access when the role is unchanged or role provisioning is disabled.

Sister PR: https://github.com/SpecterOps/bloodhound-enterprise/pull/2400

• Both PRs must be ready before merging. Merge this PR first, then update the Enterprise pin to the merged revision.

Motivation and Context

Resolves BED-9921

Previously, promoted users could remain restricted and demoted users could retain broader environment access.

How Has This Been Tested?

Passed:

go test ./cmd/api/src/api/v2/auth -count=1

Rollback: revert the code; persisted access flags require review.

Screenshots (optional):

N/A — backend change.

Types of changes

• Bug fix (non-breaking change which fixes an issue)

Checklist:

• I have met the contributing prerequisites
  • Assigned myself to this PR
  • Added the appropriate labels
  • Associated an issue: BED-9921
  • Read the Contributing guide: https://github.com/SpecterOps/BloodHound/wiki/Contributing
• I have ensured that related documentation is up-to-date
  • Open API docs
  • Code comments (GoDocs / JSDocs)
• I have followed proper test practices
  • Added/updated tests to cover my changes
  • All new and existing tests passed

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts