Guard the group paths against self-lockout, and title a read-only user page View user #195

2026-10-31T10:47:53+01:00

lilleman commented

2026-10-31 10:47:53 +01:00

Items 3 and 40. The Groups screen refuses unticking a permission, removing yourself (or a group you are in), or deleting a group, when you are in it and would lose a permission you don't hold directly. A users:read holder sees the user page as View user.

lilleman added 2 commits 2026-10-31 10:47:53 +01:00

Record the reading cost of the chunk before item 3 fcc5e04e0d

Refuse a group change that would lock the acting admin out, and title a read-only user page View user

CI / full-gate (push) Successful in 3m22s

Details

ad812e17c2

lilleman added 4 commits 2026-10-31 11:02:55 +01:00

Answer security round 1: 0 🔴, 0 🟡 (0 misread); clean c36f393fff

Answer stability round 1: 0 🔴, 2 🟡 (0 misread); tests pin all three user-page modes and the refusal page's group, the guard checks membership before the per-permission walk, logs the action and what was lost 35f71d435b

Answer product-owner round 1: 0 🔴, 1 🟡 (0 misread); the refusal names the permissions you would lose 8906340cf8

Answer prose round 1: 0 🔴, 3 🟡 (0 misread); the pageError comment is true, nested-group removal is unambiguous, the trade-off lives only at the guard

CI / full-gate (push) Successful in 3m20s