4 Commits

Author	SHA1	Message	Date
lilleman	1787754781	Extend the read-only treatment to OAuth2 clients and write-intent GETs	2026-08-05 15:38:56 +02:00
lilleman	29d654c012	Permissions are a fixed list from plugin code; grant them on Users and Groups	2026-08-05 15:38:21 +02:00
lilleman	fb4382be9d	Enforce the permission-name rule at discovery, for every plugin	2026-08-05 15:38:00 +02:00
lilleman	27fee5f8a3	Permission names are <resource>:<action>, replacing the catch-all admin permission	2026-08-05 15:37:39 +02:00