server: fix operator precedence in the updateResourceLimit own-domain guard - #14141

Description

The domain branch guard in updateResourceLimit is ownDomain && type == DOMAIN_ADMIN || type == RESOURCE_DOMAIN_ADMIN. Since && binds tighter than ||, a resource domain admin is denied updating the limits of every domain, including its own sub-domains ("Unable to update resource limit for domain X, permission denied"). The intent, like the account branch just above it, is only to block an admin on its own domain. This adds the missing parentheses.

Resource domain admins exist only in domains that own a private zone, so this affects those setups. The own domain rule is unchanged, and so is the own account rule discussed in #10922. The same code is on 4.20, 4.22 and main, so this targets 4.20.

Types of changes

• Breaking change (fix or feature that would cause existing functionality to change)
• New feature (non-breaking change which adds functionality)
• Bug fix (non-breaking change which fixes an issue)
• Enhancement (improves an existing feature and functionality)
• Cleanup (Code refactoring and cleanup, that may add test cases)
• build/CI
• test (unit or integration test code)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

• Major
• Minor

Bug Severity

• BLOCKER
• Critical
• Major
• Minor
• Trivial

Screenshots (if appropriate):

N/A

How Has This Been Tested?

Added two tests to ResourceLimitManagerImplTest: a resource domain admin updating a sub-domain (fails before with PermissionDeniedException, passes after) and the same admin on its own domain (denied before and after). The class passes (57 tests).

Also verified on a live 4.23 KVM environment with the same change: domain /rl-live with sub-domain /rl-live/rl-live-sub, and a Resource Admin account rladmin in /rl-live calling updateResourceLimit (user VMs, max 10).

Before:

rl-live-sub  531 Unable to update resource limit for domain 5, permission denied
rl-live      531 Unable to update resource limit for domain 4, permission denied

After:

rl-live-sub  200 {"resourcelimit":{"domain":"rl-live-sub",...,"max":10}}
rl-live      531 Unable to update resource limit for domain 4, permission denied

How did you try to break this feature and the system with this change?

Domain admins and root admins behave exactly as before, and both admin types are still denied on their own domain. A resource domain admin on another domain still has to pass checkAccess and the parent domain limit check, so it cannot reach domains outside its tree.