Permission names are <resource>:<action>; permissions come from plugin code #58

Merged
lilleman merged 12 commits from permission-naming into main 2026-08-05 18:04:34 +02:00

12 Commits

Author SHA1 Message Date
lilleman 2852722873 Record the stale-copy trap as accepted until the apiVersion freeze lifts
CI / full-gate (push) Successful in 2m41s
Mirror / github-mirror (push) Successful in 3s
2026-08-05 18:00:38 +02:00
lilleman 45b16824f1 Point a failed discovery at the stale plugins/ copy, and document upgrading
CI / full-gate (push) Successful in 2m39s
2026-08-05 17:52:43 +02:00
lilleman f76cd2a267 Todo updates
CI / full-gate (push) Successful in 2m42s
2026-08-05 17:48:55 +02:00
lilleman 38ebe40398 Never fail the boot on operator env; drop unusable ADMIN_PERMISSIONS with a warning
CI / full-gate (push) Successful in 2m40s
2026-08-05 17:36:04 +02:00
lilleman 1f0956dd58 Keep the group-delete confirm in user terms, not tuple mechanics
CI / full-gate (push) Successful in 2m39s
2026-08-05 15:39:08 +02:00
lilleman edcd9fefc8 Deleting a group revokes the permissions it granted 2026-08-05 15:39:08 +02:00
lilleman 1787754781 Extend the read-only treatment to OAuth2 clients and write-intent GETs 2026-08-05 15:38:56 +02:00
lilleman 765f349007 Model the read/write split in the UI: read-only views, self-revoke and inherited-grant guards 2026-08-05 15:38:37 +02:00
lilleman 29d654c012 Permissions are a fixed list from plugin code; grant them on Users and Groups 2026-08-05 15:38:21 +02:00
lilleman fb4382be9d Enforce the permission-name rule at discovery, for every plugin 2026-08-05 15:38:00 +02:00
lilleman 90cbc47607 Seed the demo admin from the mounted plugins, not the image's empty copy 2026-08-05 15:37:39 +02:00
lilleman 27fee5f8a3 Permission names are <resource>:<action>, replacing the catch-all admin permission 2026-08-05 15:37:39 +02:00