5 Commits

Author	SHA1	Message	Date
Jeffrey Smith	b10f5bee05	drop users.role column: full RBAC through group membership ... The role column was a pre-RBAC artifact. All authorization now flows through explicit group membership and permission grants: - Everyone group: all users added on creation (no implicit membership) - Admins group: grants surface.admin.access + all platform permissions - JWT claims, login response, profile: role field removed - OIDC: isIdPAdmin() maps IdP claims → Admins group (no role writes) - Admin UI: role dropdown removed, admin managed through groups - Middleware cache simplified to isActive only 28 files changed, -79 lines net. Zero magic roles. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-26 17:23:12 +00:00
Jeffrey Smith	e8e45184f7	remove token budgets + allowed models from groups ... Provider-era cruft: token_budget_daily, token_budget_monthly, and allowed_models columns removed from groups table (both dialects). ResolveTokenBudget() and ResolveModelAllowlist() deleted. GroupPatch trimmed to name/description/permissions. Admin groups UI simplified to permissions-only. -283 lines. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-26 16:53:18 +00:00
Jeffrey Smith	316c9cbfa7	admin → RBAC group migration: grant-based access replaces role check ... surface.admin.access permission + seeded Admins system group replaces hardcoded role == "admin" middleware checks. Admin bypass removed from RequirePermission — all permissions flow through group membership. Bootstrap, seed, OIDC, and admin handlers sync group membership on role changes. Demotion/deletion safeguards use group member count. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-26 16:14:46 +00:00
Jeffrey Smith	e4b7ee98a5	step 5 (partial): strip dropped packages from production code ... Removed all references to dropped packages in non-test code. Zero dropped imports, store refs, or model types remaining. Major removals: - scheduler/ package (entire dir) — tasks moved to extension track - taskutil/ package (entire dir) - health/ package (entire dir) — provider/tool health - sandbox/provider_module.go — provider.complete module - handlers: workflow_entry, workflow_instances, workflow_forms, workflow_assignments, workflow_monitor, health_admin (6 files) - auth/session.go, middleware/session_auth.go - store/{postgres,sqlite}/sessions.go, tasks.go Rewrites: - store/{postgres,sqlite}/health.go — kernel-only Prune (ws_tickets, rate_limit_counters, stale presence) - handlers/admin.go: 847→467 lines (stripped provider CRUD) - handlers/teams.go: 520→411 lines (stripped model listing) - sandbox/runner.go: removed ProviderResolver - sandbox/workflow_module.go: 216→83 lines (definition-only) - main.go: 1579→1325 lines (stripped dropped package init) - pages/pages.go: stripped channel/session lookups - events/types.go: stripped chat/channel/workspace event routes - models: stripped stale types, constants, notification types Store interface cleanup: - Removed SessionStore, TaskStore from Stores struct - Stripped workflow assignment methods from WorkflowStore iface - Stripped assignment methods from PG+SQLite workflow stores - Updated testhelper.go table list to kernel-only Migrations: removed 008_tasks.sql (both dialects) -9665/+69 lines across 51 files.	2026-03-26 04:56:07 -04:00
Jeffrey Smith	ebea16344c	step 4: fresh kernel-only migrations ... Deleted all 23+23 old chat-switchboard migration files. Wrote 9+9 clean kernel-only migrations in postgres/ and sqlite/ subdirs. 27 tables per dialect covering all 20 store interfaces: 001: users, refresh_tokens, policies, settings, presence, oidc 002: teams, team_members, groups, group_members 003: packages, package_user_settings, ext_permissions, ext_data_tables 004: ext_connections, ext_dependencies, resource_grants 005: notifications, notification_preferences 006: audit_log 007: workflows, workflow_stages, workflow_versions 008: tasks, task_runs 009: ws_tickets, rate_limit_counters Dropped: providers, personas, channels, messages, knowledge, notes, memory, workspaces, projects, folders, files, usage_log, tool_health, workflow_assignments, ext_view_channels. Schema changes vs old: - pgvector extension removed (no KB embeddings) - resource_grants: resource_type CHECK removed (open-ended) - workflow_stages: persona_id kept as nullable TEXT (no FK) - workflow_stages: stage_mode default=form_only, added custom - tasks: dropped output_channel_id, provider_config_id columns - tasks: task_type removed prompt, output_mode: notification|webhook|log - task_runs: dropped channel_id - platform_policies: kernel-only seeds - global_settings: kernel-only seeds, site name=Switchboard Core - Everyone group: kernel permissions (extension.use, workflow.submit) -2815/+487 lines.	2026-03-25 20:22:02 -04:00