pastilhasandClaude Fable 5
6071ded175
TODO.md had reached 1050 lines and 72 open items across 28 sections, read mostly on a phone. It is now a directory: todo/<theme>/<item>.md, one card per file, with frontmatter carrying id, status, created date and order, and the prose body copied across verbatim. TODO.md becomes a generated index (bun run todo:index). Dates: where an item's prose stated one it is used; otherwise its old section's; otherwise 2026-08-20, floored at the day before the split rather than invented. date_source records which. Shaped for a two-way Kanban board, filed as todo/tooling — a card is a file, id is the identity, frontmatter is the machine's half and the body is the owner's. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
18 lines
911 B
Markdown
18 lines
911 B
Markdown
---
|
|
id: multi-user/a-plugin-s-settings-routes-are-reachable-by
|
|
title: "A plugin's settings routes are reachable by anyone the plugin is granted to"
|
|
theme: multi-user
|
|
status: open
|
|
created: 2026-08-21
|
|
date_source: stated
|
|
order: 1
|
|
---
|
|
|
|
**A plugin's settings routes are reachable by anyone the plugin is granted to.** Jellyfin's
|
|
`/_config` stores a server's admin token and drives provisioning, and a Member granted the plugin
|
|
can reach it. Agreed 2026-08-21 that the plugin should enforce this from facts the platform passes
|
|
(`isOwner` plus the effective level, never the role name), with a proposal to declare owner-only
|
|
path prefixes in the manifest so forgetting the check is not a silent hole. **Blocked on credential
|
|
resolution:** connections are per-user, so locking `/_config` today leaves a Member with a plugin
|
|
that only shows a connect form they may not submit. See `docs/plugin-route-authorization.md`.
|