4 Commits

Author	SHA1	Message	Date
lilleman	151117680a	Extend the read-only treatment to OAuth2 clients and write-intent GETs	2026-08-05 15:08:31 +02:00
lilleman	0011182f16	Permissions are a fixed list from plugin code; grant them on Users and Groups	2026-08-05 14:29:15 +02:00
lilleman	b6f4e5366a	Enforce the permission-name rule at discovery, for every plugin	2026-08-05 13:00:23 +02:00
lilleman	065d865d24	Permission names are <resource>:<action>, replacing the catch-all admin permission	2026-08-05 12:45:06 +02:00