switchboard/core
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Releases 9 Wiki Activity

admin → RBAC group migration: grant-based access replaces role check
All checks were successful
CI/CD / detect-changes (pull_request) Successful in 19s
Details
CI/CD / test-frontend (pull_request) Has been skipped
Details
CI/CD / test-go-pg (pull_request) Successful in 2m14s
Details
CI/CD / test-sqlite (pull_request) Successful in 2m56s
Details
CI/CD / build-and-deploy (pull_request) Successful in 1m21s
Details

Browse Source 
surface.admin.access permission + seeded Admins system group replaces
hardcoded role == "admin" middleware checks. Admin bypass removed from
RequirePermission — all permissions flow through group membership.
Bootstrap, seed, OIDC, and admin handlers sync group membership on
role changes. Demotion/deletion safeguards use group member count.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Jeffrey Smith
2026-03-26 16:14:46 +00:00
parent b9180d4184
commit 316c9cbfa7
15 changed files with 208 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
server/handlers/extension_test.go
View File

@@ -73,7 +73,7 @@ func setupExtensionHarness(t *testing.T) *extensionHarness {
// Admin extension endpoints
admin := api.Group("/admin")
admin.Use(middleware.Auth(cfg, stores.Users, userCache), middleware.RequireAdmin())
admin.Use(middleware.Auth(cfg, stores.Users, userCache), middleware.RequireAdmin(stores))
admin.GET("/extensions", extH.AdminListExtensions)
admin.POST("/extensions", extH.AdminInstallExtension)
admin.PUT("/extensions/:id", extH.AdminUpdateExtension)
@@ -84,6 +84,7 @@ func setupExtensionHarness(t *testing.T) *extensionHarness {
`INSERT INTO users (username, email, password_hash, role, handle, auth_source) VALUES ($1, $2, $3, $4, $5, $6) RETURNING id`,
"ext-admin", "ext-admin@test.com", "$2a$10$test", "admin", "ext-admin", "builtin",
)
database.SeedAdminsGroupMember(t, adminID)
adminToken := makeToken(adminID, "ext-admin@test.com", "admin")
// Seed regular user