pastilhas
2e8ec845c8
The word meant four different things in this repo, not the three the offscale
doc records:
1. the permission registry → RENAMED here
2. $OFFICER_ROOT/capabilities/ items → kept; this is what capabilities are
3. sidecar routing keys → step 3, becoming `handles`
4. Lightning wallet features → kept; a domain term, and on the wire
to the mobile apps
The fourth was not in the doc and a global find-and-replace would have broken
the mobile wallet, which reads `{ kind, capabilities: Capability[] }` from the
wallet sidecar. So this renamed against an explicit file allowlist rather than
by sweeping the tree, and `CapabilityPage.tsx` — the UI for the item store, and
correctly named already — was left alone.
Moved: servers/capabilities/ → servers/permissions/, capability-gate.ts →
permission-gate.ts, users/capabilities-routes.ts → permissions-routes.ts,
hooks/useCapabilities.ts → usePermissions.ts. Identifiers follow.
Three breaks the typechecker could not see, all found by exercising it live.
The route paths moved with the prose sweep, so the server served
/user/permissions while the frontend still called /user/capabilities. A 404 on
every page load, and tsgo clean throughout.
The response FIELD moved too. `client.get<SelfPermissions>()` is an unchecked
cast, so `data.capabilities` became `undefined` at runtime with no compile
error — `can()` would have answered "no" to everything and the dock would have
emptied itself.
And the grants list was passed straight out of the database, so it arrived as
`{ role, capability, level }` while the screen read `grant.permission`. Every
role would have rendered as holding nothing. It is now mapped in the route:
the wire says `permission`, the column still says `capability`, and step 2
therefore changes nothing any client can see.
The stale react-query keys were the quiet one: two files still invalidated
['self-capabilities'] after the hook moved to ['self-permissions'], so
installing a plugin would have silently stopped refreshing the dock.
The database is untouched — `role_capabilities` and its `capability` column are
step 2, and the two call sites that cross that boundary say so in a comment.
Round-tripped the 9 live grants through the admin endpoint to prove the PUT
contract survived: 9 before, 9 after, Member's three intact.
Also reverted prettier churn on five landing-page files that a broad --write
picked up. Second time today; the lesson is not sticking.
tsgo clean. 797 tests, 787 pass, same 7 pre-existing failures — two of which
now read "path → permission" rather than "path → capability".
42 lines
2.3 KiB
TypeScript
42 lines
2.3 KiB
TypeScript
import type { MiddlewareHandler } from 'hono';
|
|
import { createRouter } from '@@/create-router';
|
|
import { originMiddleware } from '@@/_middlewares';
|
|
import { isSuperAdmin } from '@@/super-admin';
|
|
import * as errors from '@@/custom-errors';
|
|
import { updateUserHandler } from './update-user';
|
|
import { listUsersHandler, updateUserRoleHandler, deleteUserHandler } from './manage-users';
|
|
import { createUserHandler } from './create-user';
|
|
import { provisionLinuxHandler } from './provision-linux-route';
|
|
import { resetUserPasswordHandler } from './reset-user-password';
|
|
import { permissionAdminRouter } from './permissions-routes';
|
|
|
|
export const usersRouter = createRouter();
|
|
usersRouter.use(originMiddleware);
|
|
|
|
// Self-update. Any signed-in account may change its own name, username and avatar.
|
|
usersRouter.put('/', updateUserHandler);
|
|
|
|
// Everything below manages OTHER accounts and is the owner's alone. The global permission gate in
|
|
// hono.ts already refuses a non-owner here — `user-admin` is `kind: 'admin'`, so it is
|
|
// not grantable — but that router-level rule cannot see the one exception beside it: `PUT /` is
|
|
// declared `selfService` so every account can edit its own profile. This gate is what keeps that
|
|
// exception from widening to the routes below it, and it is a second lock rather than a restatement.
|
|
const ownerGate: MiddlewareHandler = async (ctx, next) => {
|
|
if (!(await isSuperAdmin(ctx.get('user')))) throw errors.FORBIDDEN('User management is owner-only');
|
|
return next();
|
|
};
|
|
|
|
usersRouter.get('/', ownerGate, listUsersHandler);
|
|
// POST, not PUT — and worth noting they sit one line apart. `PUT /` is the selfService exception every
|
|
// account may call on itself; `POST /` creates somebody else and is the owner's alone.
|
|
usersRouter.post('/', ownerGate, createUserHandler);
|
|
usersRouter.patch('/:id/role', ownerGate, updateUserRoleHandler);
|
|
usersRouter.post('/:id/provision-linux', ownerGate, provisionLinuxHandler);
|
|
// Generates a new platform password, returns it once, and signs the account out everywhere. Not the same
|
|
// thing as auth/reset-password.ts, which is the token flow the person runs on themselves.
|
|
usersRouter.post('/:id/password', ownerGate, resetUserPasswordHandler);
|
|
usersRouter.delete('/:id', ownerGate, deleteUserHandler);
|
|
|
|
// Which permissions each role holds. Owner-gated inside its own router.
|
|
usersRouter.route('/', permissionAdminRouter);
|