Jeffrey Smith
b10f5bee05
All checks were successful
CI/CD / detect-changes (pull_request) Successful in 4s
CI/CD / test-frontend (pull_request) Successful in 5s
CI/CD / test-go-pg (pull_request) Successful in 2m22s
CI/CD / test-sqlite (pull_request) Successful in 2m35s
CI/CD / build-and-deploy (pull_request) Successful in 1m18s
The role column was a pre-RBAC artifact. All authorization now flows through explicit group membership and permission grants: - Everyone group: all users added on creation (no implicit membership) - Admins group: grants surface.admin.access + all platform permissions - JWT claims, login response, profile: role field removed - OIDC: isIdPAdmin() maps IdP claims → Admins group (no role writes) - Admin UI: role dropdown removed, admin managed through groups - Middleware cache simplified to isActive only 28 files changed, -79 lines net. Zero magic roles. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
78 lines
2.8 KiB
Go
78 lines
2.8 KiB
Go
package auth
|
|
|
|
import (
|
|
"context"
|
|
|
|
"switchboard-core/store"
|
|
)
|
|
|
|
// EveryoneGroupID is the stable ID of the implicit "Everyone" group seeded in
|
|
// migration 002. Every authenticated user receives its permissions without an
|
|
// explicit membership row.
|
|
const EveryoneGroupID = "00000000-0000-0000-0000-000000000001"
|
|
|
|
// AdminsGroupID is the stable ID of the "Admins" system group seeded in
|
|
// migration 002. Members receive surface.admin.access and all platform
|
|
// permissions. Replaces the legacy users.role = 'admin' check.
|
|
const AdminsGroupID = "00000000-0000-0000-0000-000000000002"
|
|
|
|
// Permission constants — domain.action convention.
|
|
const (
|
|
PermSurfaceAdminAccess = "surface.admin.access" // full admin panel access (replaces role check)
|
|
PermExtensionUse = "extension.use" // use installed extensions
|
|
PermExtensionInstall = "extension.install" // install/manage extension packages
|
|
PermWorkflowCreate = "workflow.create" // create workflow definitions
|
|
PermWorkflowSubmit = "workflow.submit" // submit to public workflows
|
|
PermAdminView = "admin.view" // read-only admin panel access
|
|
PermTokenUnlimited = "token.unlimited" // bypass token budgets
|
|
)
|
|
|
|
// AllPermissions is the complete set of valid permission strings.
|
|
// Used for validation in handlers and rendering checkboxes in admin UI.
|
|
var AllPermissions = []string{
|
|
PermSurfaceAdminAccess,
|
|
PermExtensionUse,
|
|
PermExtensionInstall,
|
|
PermWorkflowCreate,
|
|
PermWorkflowSubmit,
|
|
PermAdminView,
|
|
PermTokenUnlimited,
|
|
}
|
|
|
|
// ── Resolution ──────────────────────────────
|
|
|
|
// ResolvePermissions returns the effective permission set for a user.
|
|
// Unions permissions from all groups the user is a member of (including Everyone).
|
|
func ResolvePermissions(ctx context.Context, stores store.Stores, userID string) (map[string]bool, error) {
|
|
perms := make(map[string]bool)
|
|
|
|
groups, err := stores.Groups.ListForUser(ctx, userID)
|
|
if err != nil {
|
|
return perms, err
|
|
}
|
|
for _, g := range groups {
|
|
for _, p := range g.Permissions {
|
|
perms[p] = true
|
|
}
|
|
}
|
|
|
|
return perms, nil
|
|
}
|
|
|
|
// EnsureEveryoneGroup adds a user to the Everyone group (idempotent).
|
|
// Called on every user creation path so that Everyone membership is explicit.
|
|
func EnsureEveryoneGroup(ctx context.Context, stores store.Stores, userID string) {
|
|
_ = stores.Groups.AddMember(ctx, EveryoneGroupID, userID, userID)
|
|
}
|
|
|
|
// AddToAdminsGroup adds a user to the Admins group (idempotent).
|
|
func AddToAdminsGroup(ctx context.Context, stores store.Stores, userID string) {
|
|
_ = stores.Groups.AddMember(ctx, AdminsGroupID, userID, userID)
|
|
}
|
|
|
|
// RemoveFromAdminsGroup removes a user from the Admins group.
|
|
func RemoveFromAdminsGroup(ctx context.Context, stores store.Stores, userID string) {
|
|
_ = stores.Groups.RemoveMember(ctx, AdminsGroupID, userID)
|
|
}
|
|
|