switchboard/core
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Releases 9 Wiki Activity

Feat admin rbac migration (#1)
Some checks failed
CI/CD / detect-changes (push) Successful in 4s
Details
CI/CD / test-frontend (push) Successful in 5s
Details
CI/CD / build-and-deploy (push) Has been cancelled
Details
CI/CD / test-sqlite (push) Has been cancelled
Details
CI/CD / test-go-pg (push) Has been cancelled
Details

Browse Source 
Co-authored-by: Jeffrey Smith <jasafpro@gmail.com>
Co-committed-by: Jeffrey Smith <jasafpro@gmail.com>
This commit was merged in pull request #1.
This commit is contained in:
Jeffrey Smith
2026-03-26 17:30:36 +00:00
committed by xcaliber
parent b9180d4184
commit 5836ddad21
37 changed files with 381 additions and 547 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
server/database/migrations/postgres/001_core.sql
View File

@@ -23,8 +23,6 @@ CREATE TABLE IF NOT EXISTS users (
password_hash TEXT,
display_name VARCHAR(100),
avatar_url TEXT,
role VARCHAR(20) DEFAULT 'user'
CHECK (role IN ('user', 'admin')),
is_active BOOLEAN DEFAULT true,
settings JSONB DEFAULT '{}'::jsonb,
auth_source VARCHAR(20) NOT NULL DEFAULT 'builtin'

16
server/database/migrations/postgres/002_teams.sql
View File

@@ -44,9 +44,6 @@ CREATE TABLE IF NOT EXISTS groups (
source VARCHAR(20) NOT NULL DEFAULT 'manual'
CHECK (source IN ('manual', 'oidc', 'system')),
permissions JSONB NOT NULL DEFAULT '[]'::jsonb,
token_budget_daily BIGINT,
token_budget_monthly BIGINT,
allowed_models JSONB,
created_at TIMESTAMPTZ DEFAULT NOW(),
updated_at TIMESTAMPTZ DEFAULT NOW(),
CONSTRAINT groups_scope_team CHECK (
@@ -83,3 +80,16 @@ VALUES (
'["extension.use","workflow.submit"]'::jsonb
)
ON CONFLICT (id) DO NOTHING;
-- Seed Admins group — members receive full platform permissions.
-- Replaces the legacy users.role = 'admin' authorization check.
-- Membership is managed by bootstrap/seed logic at runtime.
INSERT INTO groups (id, name, description, scope, created_by, source, permissions)
VALUES (
'00000000-0000-0000-0000-000000000002',
'Admins',
'Full platform access — replaces legacy admin role.',
'global', NULL, 'system',
'["surface.admin.access","extension.use","extension.install","workflow.create","workflow.submit","admin.view","token.unlimited"]'::jsonb
)
ON CONFLICT (id) DO NOTHING;

1
server/database/migrations/sqlite/001_core.sql
View File

@@ -12,7 +12,6 @@ CREATE TABLE IF NOT EXISTS users (
password_hash TEXT,
display_name TEXT,
avatar_url TEXT,
role TEXT DEFAULT 'user' CHECK (role IN ('user', 'admin')),
is_active INTEGER DEFAULT 1,
settings TEXT DEFAULT '{}',
auth_source TEXT NOT NULL DEFAULT 'builtin',

15
server/database/migrations/sqlite/002_teams.sql
View File

@@ -40,9 +40,6 @@ CREATE TABLE IF NOT EXISTS groups (
created_by TEXT REFERENCES users(id),
source TEXT NOT NULL DEFAULT 'manual' CHECK (source IN ('manual', 'oidc', 'system')),
permissions TEXT NOT NULL DEFAULT '[]',
token_budget_daily INTEGER,
token_budget_monthly INTEGER,
allowed_models TEXT,
created_at TEXT DEFAULT (datetime('now')),
updated_at TEXT DEFAULT (datetime('now'))
);
@@ -74,3 +71,15 @@ VALUES (
'global', NULL, 'system',
'["extension.use","workflow.submit"]'
);
-- Seed Admins group — members receive full platform permissions.
-- Replaces the legacy users.role = 'admin' authorization check.
-- Membership is managed by bootstrap/seed logic at runtime.
INSERT OR IGNORE INTO groups (id, name, description, scope, created_by, source, permissions)
VALUES (
'00000000-0000-0000-0000-000000000002',
'Admins',
'Full platform access — replaces legacy admin role.',
'global', NULL, 'system',
'["surface.admin.access","extension.use","extension.install","workflow.create","workflow.submit","admin.view","token.unlimited"]'
);