Jeffrey Smith
e8e45184f7
All checks were successful
CI/CD / detect-changes (pull_request) Successful in 4s
CI/CD / test-frontend (pull_request) Successful in 5s
CI/CD / test-go-pg (pull_request) Successful in 2m12s
CI/CD / test-sqlite (pull_request) Successful in 2m45s
CI/CD / build-and-deploy (pull_request) Successful in 1m18s
Provider-era cruft: token_budget_daily, token_budget_monthly, and allowed_models columns removed from groups table (both dialects). ResolveTokenBudget() and ResolveModelAllowlist() deleted. GroupPatch trimmed to name/description/permissions. Admin groups UI simplified to permissions-only. -283 lines. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
82 lines
2.9 KiB
Go
82 lines
2.9 KiB
Go
package auth
|
|
|
|
import (
|
|
"context"
|
|
|
|
"switchboard-core/store"
|
|
)
|
|
|
|
// EveryoneGroupID is the stable ID of the implicit "Everyone" group seeded in
|
|
// migration 002. Every authenticated user receives its permissions without an
|
|
// explicit membership row.
|
|
const EveryoneGroupID = "00000000-0000-0000-0000-000000000001"
|
|
|
|
// AdminsGroupID is the stable ID of the "Admins" system group seeded in
|
|
// migration 002. Members receive surface.admin.access and all platform
|
|
// permissions. Replaces the legacy users.role = 'admin' check.
|
|
const AdminsGroupID = "00000000-0000-0000-0000-000000000002"
|
|
|
|
// Permission constants — domain.action convention.
|
|
const (
|
|
PermSurfaceAdminAccess = "surface.admin.access" // full admin panel access (replaces role check)
|
|
PermExtensionUse = "extension.use" // use installed extensions
|
|
PermExtensionInstall = "extension.install" // install/manage extension packages
|
|
PermWorkflowCreate = "workflow.create" // create workflow definitions
|
|
PermWorkflowSubmit = "workflow.submit" // submit to public workflows
|
|
PermAdminView = "admin.view" // read-only admin panel access
|
|
PermTokenUnlimited = "token.unlimited" // bypass token budgets
|
|
)
|
|
|
|
// AllPermissions is the complete set of valid permission strings.
|
|
// Used for validation in handlers and rendering checkboxes in admin UI.
|
|
var AllPermissions = []string{
|
|
PermSurfaceAdminAccess,
|
|
PermExtensionUse,
|
|
PermExtensionInstall,
|
|
PermWorkflowCreate,
|
|
PermWorkflowSubmit,
|
|
PermAdminView,
|
|
PermTokenUnlimited,
|
|
}
|
|
|
|
// ── Resolution ──────────────────────────────
|
|
|
|
// ResolvePermissions returns the effective permission set for a user.
|
|
// Always includes the Everyone group regardless of membership.
|
|
// Includes both implicit Everyone group and explicit group memberships.
|
|
func ResolvePermissions(ctx context.Context, stores store.Stores, userID string) (map[string]bool, error) {
|
|
perms := make(map[string]bool)
|
|
|
|
// Always apply Everyone group — no membership row required.
|
|
if everyone, err := stores.Groups.GetByID(ctx, EveryoneGroupID); err == nil {
|
|
for _, p := range everyone.Permissions {
|
|
perms[p] = true
|
|
}
|
|
}
|
|
|
|
// Union all explicit group memberships.
|
|
groups, err := stores.Groups.ListForUser(ctx, userID)
|
|
if err != nil {
|
|
return perms, err
|
|
}
|
|
for _, g := range groups {
|
|
for _, p := range g.Permissions {
|
|
perms[p] = true
|
|
}
|
|
}
|
|
|
|
return perms, nil
|
|
}
|
|
|
|
// SyncAdminsGroupMembership adds or removes a user from the Admins group
|
|
// based on their role. Called by auth providers and admin handlers when
|
|
// a user's role changes so that permissions stay in sync.
|
|
func SyncAdminsGroupMembership(ctx context.Context, stores store.Stores, userID, role string) {
|
|
if role == "admin" {
|
|
_ = stores.Groups.AddMember(ctx, AdminsGroupID, userID, userID)
|
|
} else {
|
|
_ = stores.Groups.RemoveMember(ctx, AdminsGroupID, userID)
|
|
}
|
|
}
|
|
|