switchboard/core
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Releases 9 Wiki Activity

admin → RBAC group migration: grant-based access replaces role check
All checks were successful
CI/CD / detect-changes (pull_request) Successful in 19s
Details
CI/CD / test-frontend (pull_request) Has been skipped
Details
CI/CD / test-go-pg (pull_request) Successful in 2m14s
Details
CI/CD / test-sqlite (pull_request) Successful in 2m56s
Details
CI/CD / build-and-deploy (pull_request) Successful in 1m21s
Details

Browse Source 
surface.admin.access permission + seeded Admins system group replaces
hardcoded role == "admin" middleware checks. Admin bypass removed from
RequirePermission — all permissions flow through group membership.
Bootstrap, seed, OIDC, and admin handlers sync group membership on
role changes. Demotion/deletion safeguards use group member count.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Jeffrey Smith
2026-03-26 16:14:46 +00:00
parent b9180d4184
commit 316c9cbfa7
15 changed files with 208 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
ROADMAP.md
View File

@@ -36,11 +36,17 @@ platform that extensions build on.
The contract that extensions build against. Three trigger primitives,
SDK stabilization, and the first rebuilt extension (tasks).
- **Trigger system**: time (cron), webhook (inbound HTTP), event (bus subscription)
| Step | Status | Description |
|------|--------|-------------|
| Admin → RBAC group | ✅ | `surface.admin.access` permission + Admins system group replaces `role == "admin"` checks. Admin bypass removed from permission middleware. |
| Settings cascade | 🔲 | `user_overridable` flag, RBAC scope auth, resolution chain |
| ICD (API contract) | 🔲 | OpenAPI spec from registered routes, kernel-only endpoint docs |
| Trigger system | 🔲 | Time (cron), webhook (inbound HTTP), event (bus subscription) |
| SDK stabilization | 🔲 | `sb.slots()`, `sb.actions`, `sb.api.ext()`, `sb.storage`, theme tokens, primitive UI |
### Remaining v0.2.0 features
- **Event bus subscriptions**: extensions register match expressions at install time
- **SDK contract**: `sb.slots()`, `sb.actions`, `sb.api.ext()`, `sb.storage`
- **Primitive UI components**: toast, confirm, prompt, dialog (stabilize existing)
- **Theme tokens** exposed to extensions
- **Task extension**: first proof-of-concept — full task system rebuilt as a
Starlark extension using triggers + ext_data + notifications
- **Settings override model**: RBAC controls scope auth (admin → global,