switchboard/core
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Releases 9 Wiki Activity

Feat v0.7.10 workflow handoff + assignment UI
Some checks failed
CI/CD / test-sqlite (pull_request) Has been cancelled
Details
CI/CD / build-and-deploy (pull_request) Has been cancelled
Details
CI/CD / test-runners (pull_request) Has been skipped
Details
CI/CD / test-frontend (pull_request) Has been cancelled
Details
CI/CD / detect-changes (pull_request) Successful in 4s
Details
CI/CD / test-go-pg (pull_request) Has been cancelled
Details
CI/CD / e2e-smoke (pull_request) Has been cancelled
Details

Browse Source 
Public→team stage handoff with audience mismatch detection, enriched
assignment API responses (workflow_name, stage_name, sla_breached),
team inbox with claim/assign actions, assignment notifications, team
middleware system-admin bypass fix, and SDK gap closure.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Jeffrey Smith
2026-04-02 23:15:40 +00:00
parent a9cf71b76d
commit 8f8c1b0e53
17 changed files with 818 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
server/middleware/team.go
View File

@@ -5,20 +5,35 @@ import (
"github.com/gin-gonic/gin"
"armature/auth"
"armature/store"
)
// isSystemAdmin checks if the user has the surface.admin.access permission,
// which grants system-wide admin privileges including team access bypass.
func isSystemAdmin(c *gin.Context, stores store.Stores) bool {
userID := c.GetString("user_id")
if userID == "" {
return false
}
perms, err := resolveAndCachePerms(c, stores, userID)
if err != nil {
return false
}
return perms[auth.PermSurfaceAdminAccess]
}
// RequireTeamAdmin returns middleware that restricts access to team admins.
// System admins are always allowed through.
func RequireTeamAdmin(teams store.TeamStore) gin.HandlerFunc {
func RequireTeamAdmin(teams store.TeamStore, allStores ...store.Stores) gin.HandlerFunc {
return func(c *gin.Context) {
role, _ := c.Get("role")
if role == "admin" {
// System admin bypass via permissions
if len(allStores) > 0 && isSystemAdmin(c, allStores[0]) {
c.Next()
return
}
userID, _ := c.Get("user_id")
userID := c.GetString("user_id")
teamID := c.Param("teamId")
if teamID == "" {
c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{
@@ -27,7 +42,7 @@ func RequireTeamAdmin(teams store.TeamStore) gin.HandlerFunc {
return
}
isAdmin, err := teams.IsTeamAdmin(c.Request.Context(), teamID, userID.(string))
isAdmin, err := teams.IsTeamAdmin(c.Request.Context(), teamID, userID)
if err != nil || !isAdmin {
c.AbortWithStatusJSON(http.StatusForbidden, gin.H{
"error": "team admin access required",
@@ -42,15 +57,15 @@ func RequireTeamAdmin(teams store.TeamStore) gin.HandlerFunc {
// RequireTeamMember returns middleware that restricts access to users who
// belong to the team identified by :teamId (any role).
// System admins are always allowed through.
func RequireTeamMember(teams store.TeamStore) gin.HandlerFunc {
func RequireTeamMember(teams store.TeamStore, allStores ...store.Stores) gin.HandlerFunc {
return func(c *gin.Context) {
role, _ := c.Get("role")
if role == "admin" {
// System admin bypass via permissions
if len(allStores) > 0 && isSystemAdmin(c, allStores[0]) {
c.Next()
return
}
userID, _ := c.Get("user_id")
userID := c.GetString("user_id")
teamID := c.Param("teamId")
if teamID == "" {
c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{
@@ -59,7 +74,7 @@ func RequireTeamMember(teams store.TeamStore) gin.HandlerFunc {
return
}
isMember, _ := teams.IsMember(c.Request.Context(), teamID, userID.(string))
isMember, _ := teams.IsMember(c.Request.Context(), teamID, userID)
if !isMember {
c.AbortWithStatusJSON(http.StatusForbidden, gin.H{
"error": "team membership required",