switchboard/core
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Releases 9 Wiki Activity

drop users.role column: full RBAC through group membership
All checks were successful
CI/CD / detect-changes (pull_request) Successful in 4s
Details
CI/CD / test-frontend (pull_request) Successful in 5s
Details
CI/CD / test-go-pg (pull_request) Successful in 2m22s
Details
CI/CD / test-sqlite (pull_request) Successful in 2m35s
Details
CI/CD / build-and-deploy (pull_request) Successful in 1m18s
Details

Browse Source 
The role column was a pre-RBAC artifact. All authorization now flows
through explicit group membership and permission grants:

- Everyone group: all users added on creation (no implicit membership)
- Admins group: grants surface.admin.access + all platform permissions
- JWT claims, login response, profile: role field removed
- OIDC: isIdPAdmin() maps IdP claims → Admins group (no role writes)
- Admin UI: role dropdown removed, admin managed through groups
- Middleware cache simplified to isActive only

28 files changed, -79 lines net. Zero magic roles.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Jeffrey Smith
2026-03-26 17:23:12 +00:00
parent e8e45184f7
commit b10f5bee05
28 changed files with 206 additions and 285 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
server/handlers/extension_test.go
View File

@@ -81,17 +81,19 @@ func setupExtensionHarness(t *testing.T) *extensionHarness {
// Seed admin user
adminID := seedInsertReturningID(t,
`INSERT INTO users (username, email, password_hash, role, handle, auth_source) VALUES ($1, $2, $3, $4, $5, $6) RETURNING id`,
"ext-admin", "ext-admin@test.com", "$2a$10$test", "admin", "ext-admin", "builtin",
`INSERT INTO users (username, email, password_hash, handle, auth_source) VALUES ($1, $2, $3, $4, $5) RETURNING id`,
"ext-admin", "ext-admin@test.com", "$2a$10$test", "ext-admin", "builtin",
)
database.SeedEveryoneGroupMember(t, adminID)
database.SeedAdminsGroupMember(t, adminID)
adminToken := makeToken(adminID, "ext-admin@test.com", "admin")
// Seed regular user
userID := seedInsertReturningID(t,
`INSERT INTO users (username, email, password_hash, role, handle, auth_source) VALUES ($1, $2, $3, $4, $5, $6) RETURNING id`,
"ext-user", "ext-user@test.com", "$2a$10$test", "user", "ext-user", "builtin",
`INSERT INTO users (username, email, password_hash, handle, auth_source) VALUES ($1, $2, $3, $4, $5) RETURNING id`,
"ext-user", "ext-user@test.com", "$2a$10$test", "ext-user", "builtin",
)
database.SeedEveryoneGroupMember(t, userID)
userToken := makeToken(userID, "ext-user@test.com", "user")
return &extensionHarness{