larvit/plainpages
3
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

Permission names are <resource>:<action>; permissions come from plugin code #58

Merged
lilleman merged 12 commits from permission-naming into main 2026-08-05 18:04:34 +02:00
Conversation 0 Commits 12 Files Changed 53
+10 -3
2 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 90cbc47607 - Show all commits
README.md
+6 -3
View File
@@ -32,11 +32,13 @@ docker compose up -d # http://localhost:3000, live-reloads on source chan
```bash ```bash
cp -r examples/plugins/admin plugins/admin cp -r examples/plugins/admin plugins/admin
docker compose restart web docker compose up -d
``` ```
The bootstrap grants the seeded admin every permission the installed plugins declare, so the The bootstrap grants the seeded admin every permission the installed plugins declare, so the
**Admin** section now shows in the menu. **Admin** section now shows in the menu. Use `up -d`, not `restart web`: the seed runs in the
one-shot `bootstrap` service, and only `up` re-runs it to pick up the new plugin's permissions
(it is idempotent, so re-running costs nothing).
See [`examples/plugins/admin/`](examples/plugins/admin/). See [`examples/plugins/admin/`](examples/plugins/admin/).
**4. Add your first plugin.** The clone is bind-mounted into the container, so a new **4. Add your first plugin.** The clone is bind-mounted into the container, so a new
@@ -60,7 +62,8 @@ docker compose restart web
Visit <http://localhost:3000/hello> — the page is mounted at `/hello` (the folder name Visit <http://localhost:3000/hello> — the page is mounted at `/hello` (the folder name
is the plugin id *and* the mount path) and "Hello" is in the menu. That's the whole loop: is the plugin id *and* the mount path) and "Hello" is in the menu. That's the whole loop:
**drop a folder in `plugins/`, restart, it's live.** **drop a folder in `plugins/`, restart, it's live.** A plugin that declares `permissions` needs
`docker compose up -d` instead, so the seed re-runs and grants them (as in step 3).
From here, render real pages against the app shell and fetch upstream data — see From here, render real pages against the app shell and fetch upstream data — see
[Building plugins](#building-plugins) and the runnable reference in [Building plugins](#building-plugins) and the runnable reference in
compose.yml
+4
View File
@@ -139,6 +139,10 @@ services:
KRATOS_ADMIN_URL: http://kratos:4434 KRATOS_ADMIN_URL: http://kratos:4434
volumes: volumes:
- ./ory/kratos/tokenizer:/etc/config/kratos/tokenizer - ./ory/kratos/tokenizer:/etc/config/kratos/tokenizer
# The seed grants what the installed plugins declare, so bootstrap must see the same plugins/
# as web. Without this it discovers only the image's (empty) copy and the demo admin is seeded
# with nothing — a drop-in plugin's screens then 403 with nothing logged.
- ./plugins:/app/plugins:ro
command: node src/auth/bootstrap.ts command: node src/auth/bootstrap.ts
# Bounded retry: the seed is idempotent, so transient Ory blips recover — but a permanent # Bounded retry: the seed is idempotent, so transient Ory blips recover — but a permanent
# error must give up, not loop forever and hang `web` (gates on completion). # error must give up, not loop forever and hang `web` (gates on completion).