From b478cc773512896f8634e94f1a96b890a3f0aee9 Mon Sep 17 00:00:00 2001 From: Lilleman auf Larv Date: Sat, 31 Oct 2026 11:02:47 +0100 Subject: [PATCH] =?UTF-8?q?Answer=20prose=20round=201:=200=20=F0=9F=94=B4,?= =?UTF-8?q?=203=20=F0=9F=9F=A1=20(0=20misread);=20the=20pageError=20commen?= =?UTF-8?q?t=20is=20true,=20nested-group=20removal=20is=20unambiguous,=20t?= =?UTF-8?q?he=20trade-off=20lives=20only=20at=20the=20guard?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- AGENTS.md | 7 +++---- CHANGELOG.md | 9 +++++---- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 01c1d95..ab3d861 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -214,10 +214,9 @@ Revisit only if the stated reason stops holding. grant-specific guards go with it: you cannot revoke your own **direct** grants (self-lockout would need a `curl` against Keto to undo), and a permission held *through a group* renders ticked-but-disabled, because unticked stated the opposite of the truth. The group paths are - guarded too: unticking a permission on a group you are in, removing yourself or a group you are in, - or deleting the group is refused when you would lose a permission you don't hold directly. One also - held through another group counts as lost — telling them apart needs a reverse Keto query, and a - false refusal costs only asking another administrator. + guarded too: unticking a permission on a group you are in, removing yourself (or a nested group you + are in) from its members, or deleting the group is refused when you would lose a permission you + don't hold directly. - **`users:write` and `groups:write` are equivalent to full administrative access**: `groups:write` adds you to any group, including one holding every permission; `users:write` mints a recovery code for any account. The containment the split buys is real on the **read** half only (`users:read` is diff --git a/CHANGELOG.md b/CHANGELOG.md index 4a626b6..e7d177e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,10 +8,11 @@ at boot. Entries start at 0.3.0. ### The admin example stops an administrator locking themselves out through a group -On the Groups screen, unticking a permission on a group you are in, removing yourself or a group -you are in, or deleting the group is refused when it would take away a permission you don't hold -directly. The page says so, and another administrator can make the change. A permission you also -hold through another group counts as lost, so such a change is refused as well. +On the Groups screen, unticking a permission on a group you are in, removing yourself (or a nested +group you are in) from its members, or deleting the group is refused when it would take away a +permission you don't hold directly. The page names the permissions, and another administrator can +make the change. The check errs towards refusing: it also refuses when you would keep the permission +through another group, or keep your membership another way. ### The admin example titles a read-only user page "View user"