GLOBAL_READONLY_SUPER_USERS:   - audit-user
  - monitoring-bot

# Global readonly user attempts to read mirror config
curl -X GET \
  -H "Authorization: Bearer ${GLOBAL_READONLY_TOKEN}" \
  "https://quay.io/api/v1/organization/normaluser-org/mirror"

# Result: 403 Forbidden ❌

# Same user can read immutability policies
curl -X GET \
  -H "Authorization: Bearer ${GLOBAL_READONLY_TOKEN}" \
  "https://quay.io/api/v1/organization/normaluser-org/immutabilitypolicy/"

# Result: 200 OK ✅

def require_org_admin(orgname):
    """
    Check if the current user has admin permission on the organization.
    Raises Unauthorized if not.
    """
    permission = AdministerOrganizationPermission(orgname)
    if not (permission.can() or allow_if_superuser_with_full_access()):
        raise Unauthorized()
    # ❌ BUG: Missing allow_if_global_readonly_superuser() check!

# List org immutability policies (lines 74-84)
@require_scope(scopes.ORG_ADMIN)
@nickname("listOrgImmutabilityPolicies")
def get(self, orgname):
    permission = AdministerOrganizationPermission(orgname)
    if (
        not permission.can()
        and not allow_if_global_readonly_superuser()  # ✅ CORRECT
        and not (features.SUPERUSERS_FULL_ACCESS and allow_if_superuser())
    ):
        raise Unauthorized()
    # ... returns policies

# Get org mirror config (line 207)
@require_scope(scopes.ORG_ADMIN)
@nickname("getOrgMirrorConfig")
def get(self, orgname):
    require_org_admin(orgname)  # ❌ No global readonly check
    # ...

def require_org_admin(orgname, allow_readonly=False):
    """
    Check if the current user has admin permission on the organization.
    
    Args:
        orgname: Organization name
        allow_readonly: If True, allow global readonly superusers
    """
    permission = AdministerOrganizationPermission(orgname)
    if not (
        permission.can() 
        or allow_if_superuser_with_full_access()
        or (allow_readonly and allow_if_global_readonly_superuser())  # ← ADD THIS
    ):
        raise Unauthorized()

@require_scope(scopes.ORG_ADMIN)
@nickname("getOrgMirrorConfig")
def get(self, orgname):
    require_org_admin(orgname, allow_readonly=True)  # ← Enable for GET
    # ... rest of implementation

@require_scope(scopes.ORG_ADMIN)
@nickname("getOrgMirrorConfig")
def get(self, orgname):
    permission = AdministerOrganizationPermission(orgname)
    if (
        not permission.can()
        and not allow_if_global_readonly_superuser()  # ← ADD THIS
        and not allow_if_superuser_with_full_access()
    ):
        raise Unauthorized()
    
    try:
        org = model.organization.get_organization(orgname)
    except InvalidOrganizationException:
        raise NotFound()
    # ... rest of implementation

def get(self, orgname):
    # ... permission checks ...
    
    is_global_readonly = allow_if_global_readonly_superuser()
    
    try:
        username = self._decrypt_username(mirror.external_registry_username)
    except DecryptionFailureException:
        username = "(invalid. please re-enter)"
    
    # Mask password for global readonly users
    if is_global_readonly:
        password = "***REDACTED***"  # Don't expose credentials
    else:
        # Show actual password for org admins and superusers with full access
        password = username  # Current implementation returns username
    
    return {
        "external_registry_username": username,
        "external_registry_password": password,  # Masked for global readonly
        # ... other fields
    }

class TestOrgMirrorGlobalReadonly:
    """Tests for global readonly superuser access to org mirror."""

    def test_global_readonly_can_read_org_mirror_config(self, app):
        """Global readonly superuser can read mirror config."""
        # Setup: Create org mirror config
        _create_org_mirror_config("buynlarge")

        with client_with_identity("globalreadonlysuperuser", app) as cl:
            resp = conduct_api_call(
                cl, OrgMirrorConfig, "GET", {"orgname": "buynlarge"}, None, 200
            )
            assert resp.json["external_registry_url"] == "https://harbor.example.com"
            assert resp.json["external_namespace"] == "my-project"

    def test_global_readonly_password_is_masked(self, app):
        """Global readonly superuser sees masked password."""
        _create_org_mirror_config("buynlarge")

        with client_with_identity("globalreadonlysuperuser", app) as cl:
            resp = conduct_api_call(
                cl, OrgMirrorConfig, "GET", {"orgname": "buynlarge"}, None, 200
            )
            # Password should be masked
            assert resp.json["external_registry_password"] == "***REDACTED***"

    def test_global_readonly_blocked_from_create(self, app):
        """Global readonly blocked from creating mirror config."""
        with client_with_identity("globalreadonlysuperuser", app) as cl:
            conduct_api_call(
                cl,
                OrgMirrorConfig,
                "POST",
                {"orgname": "buynlarge"},
                {"external_registry_url": "https://example.com", ...},
                403,
            )

    def test_global_readonly_blocked_from_update(self, app):
        """Global readonly blocked from updating mirror config."""
        _create_org_mirror_config("buynlarge")

        with client_with_identity("globalreadonlysuperuser", app) as cl:
            conduct_api_call(
                cl,
                OrgMirrorConfig,
                "PUT",
                {"orgname": "buynlarge"},
                {"is_enabled": False},
                403,
            )

    def test_global_readonly_blocked_from_delete(self, app):
        """Global readonly blocked from deleting mirror config."""
        _create_org_mirror_config("buynlarge")

        with client_with_identity("globalreadonlysuperuser", app) as cl:
            conduct_api_call(
                cl, OrgMirrorConfig, "DELETE", {"orgname": "buynlarge"}, None, 403
            )

def test_global_readonly_org_mirror_read_only_access(app):
    """Global readonly can read but not write org mirror configs."""
    # Create config as org admin
    with client_with_identity("devtable", app) as cl:
        conduct_api_call(
            cl, OrgMirrorConfig, "POST", {"orgname": "buynlarge"}, {...}, 201
        )

    # Global readonly can read
    with client_with_identity("globalreadonlysuperuser", app) as cl:
        conduct_api_call(
            cl, OrgMirrorConfig, "GET", {"orgname": "buynlarge"}, None, 200
        )

        # But cannot modify
        conduct_api_call(
            cl, OrgMirrorConfig, "PUT", {"orgname": "buynlarge"}, {...}, 403
        )

# conf/stack/config.yaml
GLOBAL_READONLY_SUPER_USERS:   - quayadmin
  - readonly
  - audit-bot