Make the two persona references self-contained now that the section is gone

2026-08-05 23:42:58 +02:00
parent a005acb93d
commit 8a5d2dfd6c
3 changed files with 7 additions and 8 deletions
@@ -1,11 +1,10 @@
-// Reference config/menu.ts — copy into the (empty) config/ mount at the repo root:
+// Reference config/menu.ts — copy into the empty config/ mount at the repo root:
 //   cp examples/config/menu.ts config/menu.ts
-// config/ ships empty; mount your own or copy this in. Absent config = built-in defaults.
+// Absent config = built-in defaults.
 //
-// Brand the app and reorder/rename/group/hide nav nodes (by their `id`) across all plugins —
-// the override always wins, applied before the per-user permission filter. Every field is
-// optional; delete one to fall back to the default.
-// See src/ui/menu-config.ts (types), src/ui/nav.ts (NavOverride), README.md (The menu system).
+// Brand the app and reorder/rename/group/hide nav nodes (by their `id`) across all plugins — the
+// override always wins, applied before the per-user permission filter. Every field is optional.
+// See src/ui/menu-config.ts (types), src/ui/nav.ts (NavOverride), README → The menu system.

 import { defineMenu } from "#menu-config";

@@ -369,7 +369,7 @@ export const usersPermissions = withTarget(async (deps, identity, id) => {
  const diff = grantDiff(ctx.declaredPermissions, await heldPermissions(keto, subject), form.getAll(PERMISSIONS_FIELD));
  // Self-lockout guard, matching the self-deactivate/self-delete ones: revoking your own grants can
  // remove the last `users:write` on the deployment, and the instant-revoke hook lands it on the very
-  // next request. Recovery would be a curl against Keto — not something the operator persona can do.
+  // next request — leaving a `curl` against Keto as the only way back in.
  if (id === user.id && diff.revoke.length > 0) {
    ctx.log.warn("admin: refused a self-revoke of permissions", { actor: user.id, refused: diff.revoke.join(",") });
    const permissions = await userPermissionPicker(deps, id, ctx.t("admin.grants.selfRevoke"));