Permission names are <resource>:<action>; permissions come from plugin code #58

2026-08-05T12:45:19+02:00

lilleman commented

2026-08-05 12:45:19 +02:00

Permission names now follow <resource>:<action> everywhere, and the rule is enforced by the host at plugin discovery — a plugin gating on, or declaring, a badly-shaped name stops the boot like any other bad manifest. So it holds for every installed plugin, not just ones the admin GUI touches.

The catch-all admin permission is gone. Each admin screen is its own resource — users, groups, oauth2-clients — split into :read and :write, so a helpdesk account can hold users:read alone. That split is modelled in the UI, not just the gate: a read-only holder sees no create/save/delete affordance anywhere, and the Admin nav filters per screen (hold none of the three and the section disappears).

The Permissions screen is deleted. Permission names are declared in plugin code, so the host collects them into one catalog (ctx.declaredPermissions) and that fixed list is what the Users and Groups screens offer as a checkbox picker. The submitted set is the desired state; a crafted POST cannot grant an undeclared name, and a grant left behind by an uninstalled plugin is never silently revoked by an unrelated save.

Guards worth naming: you cannot revoke your own grants; a permission held through a group renders ticked-but-disabled rather than unticked (showing it unticked stated the opposite of the truth); and deleting a group now revokes the permissions it granted, instead of orphaning them to resurrect under a re-created name.

Two pre-existing bugs fixed on the way: the permission path validator was the group name regex with no colon, so /admin/permissions/scheduling:read already 404'd; and bootstrap never bind-mounted plugins/, so a dropped-in plugin's permissions were never seeded — the quick start now says docker compose up -d, which re-runs the one-shot.

Delivers both the permission-format and the permissions-as-a-list todos. Reviewed by systems-architect (3 rounds), product-owner-reviewer, and stability-reviewer (2 rounds); decisions recorded in AGENTS.md and README, deferred items in todo.md.

Permission names now follow `<resource>:<action>` everywhere, and the rule is enforced by the **host at plugin discovery** — a plugin gating on, or declaring, a badly-shaped name stops the boot like any other bad manifest. So it holds for every installed plugin, not just ones the admin GUI touches. The catch-all `admin` permission is gone. Each admin screen is its own resource — `users`, `groups`, `oauth2-clients` — split into `:read` and `:write`, so a helpdesk account can hold `users:read` alone. That split is modelled in the UI, not just the gate: a read-only holder sees no create/save/delete affordance anywhere, and the Admin nav filters per screen (hold none of the three and the section disappears). **The Permissions screen is deleted.** Permission names are declared in plugin code, so the host collects them into one catalog (`ctx.declaredPermissions`) and that fixed list is what the Users and Groups screens offer as a checkbox picker. The submitted set is the desired state; a crafted POST cannot grant an undeclared name, and a grant left behind by an uninstalled plugin is never silently revoked by an unrelated save. Guards worth naming: you cannot revoke your own grants; a permission held through a group renders ticked-but-disabled rather than unticked (showing it unticked stated the opposite of the truth); and deleting a group now revokes the permissions it granted, instead of orphaning them to resurrect under a re-created name. Two pre-existing bugs fixed on the way: the permission path validator was the *group* name regex with no colon, so `/admin/permissions/scheduling:read` already 404'd; and `bootstrap` never bind-mounted `plugins/`, so a dropped-in plugin's permissions were never seeded — the quick start now says `docker compose up -d`, which re-runs the one-shot. Delivers both the permission-format and the permissions-as-a-list todos. Reviewed by systems-architect (3 rounds), product-owner-reviewer, and stability-reviewer (2 rounds); decisions recorded in AGENTS.md and README, deferred items in todo.md.

lilleman marked the pull request as work in progress 2026-08-05 12:45:27 +02:00

lilleman changed title from ~~WIP: Permission names are <resource>:<action>, replacing the catch-all admin permission~~ to Permission names are <resource>:<action>; permissions come from plugin code

2026-08-05 15:33:58 +02:00

lilleman added 8 commits 2026-08-05 15:39:32 +02:00

Permission names are <resource>:<action>, replacing the catch-all admin permission 27fee5f8a3

Seed the demo admin from the mounted plugins, not the image's empty copy 90cbc47607

Enforce the permission-name rule at discovery, for every plugin fb4382be9d

Permissions are a fixed list from plugin code; grant them on Users and Groups 29d654c012

Model the read/write split in the UI: read-only views, self-revoke and inherited-grant guards 765f349007

Extend the read-only treatment to OAuth2 clients and write-intent GETs 1787754781

Deleting a group revokes the permissions it granted edcd9fefc8

Keep the group-delete confirm in user terms, not tuple mechanics

CI / full-gate (push) Successful in 2m39s

Details