Permissions: rename Grants, add wildcards, local groups, profile

- Rename Grant -> Permission end-to-end (model, routes, view, frontend,
  bootstrap) and add an idempotent redis migration for existing records.
- utils/roles.js: glob domain matching (* = one label, ** = any depth) against
  the full host; authz passes the full hostname.
- Local groups: LocalGroup model + admin routes/UI; membership merged into
  Permission.effectiveFor so app groups behave like SSO groups.
- Subject autocomplete via GET /api/permission/subjects (users + derived groups).
- User profile page (/profile) and username in the navbar; /api/user/me now
  returns merged/local/external groups.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

nodejs/routes/api.js

@@ -22,7 +22,10 @@ router.use('/dns', middleware.auth, require('./dns'));
 // API routes for working with hosts. All endpoints need to be have valid user.
 router.use('/cert', middleware.auth, require('./cert'));
 
-// Grant management (who can manage which domains) is global-admin-only.
-router.use('/grant', middleware.auth, authz.requireAdmin, require('./grant'));
+// Permission management (who can manage which domains) is global-admin-only.
+router.use('/permission', middleware.auth, authz.requireAdmin, require('./permission'));
+
+// Local group management is global-admin-only.
+router.use('/group', middleware.auth, authz.requireAdmin, require('./group'));
 
 module.exports = router;

nodejs/routes/dns.js

@@ -3,7 +3,7 @@
 const router = require('express').Router();
 const {DnsProvider, Domain, DynamicRecord} = require('../models').models;
 const authz = require('../middleware/authz');
-const {Grant} = require('../models/grant');
+const {Permission} = require('../models/permission');
 const {getPublicIp} = require('../utils/public_ip');
 
 const Model = DnsProvider;
@@ -123,7 +123,7 @@ router.post('/dynamic/:id/refresh', async function(req, res, next){
 	try{
 		let record = await DynamicRecord.get(req.params.id);
 		let effective = await authz.getEffective(req);
-		if(!Grant.allows(effective, 'manager', authz.toDomain(record.domain))){
+		if(!Permission.allows(effective, 'manager', authz.toDomain(record.domain))){
 			let error = new Error('Forbidden'); error.name = 'Forbidden'; error.status = 403;
 			error.message = `You need 'manager' rights on ${record.domain}.`;
 			throw error;
@@ -141,7 +141,7 @@ router.delete('/dynamic/:id', async function(req, res, next){
 	try{
 		let record = await DynamicRecord.get(req.params.id);
 		let effective = await authz.getEffective(req);
-		if(!Grant.allows(effective, 'manager', authz.toDomain(record.domain))){
+		if(!Permission.allows(effective, 'manager', authz.toDomain(record.domain))){
 			let error = new Error('Forbidden'); error.name = 'Forbidden'; error.status = 403;
 			error.message = `You need 'manager' rights on ${record.domain}.`;
 			throw error;

nodejs/routes/grant.js

@@ -1,42 +0,0 @@
-'use strict';
-
-const router = require('express').Router();
-const {Grant} = require('../models/grant');
-const {reqUsername} = require('../middleware/authz');
-
-// All grant management is admin-only; the gate is applied where this router is
-// mounted (routes/api.js).
-
-router.get('/', async function(req, res, next){
-	try{
-		return res.json({results: await Grant.listDetail()});
-	}catch(error){
-		next(error);
-	}
-});
-
-router.post('/', async function(req, res, next){
-	try{
-		req.body.created_by = reqUsername(req);
-		let grant = await Grant.create(req.body);
-		return res.json({
-			message: `Granted ${req.body.role} to ${req.body.subjectType} "${req.body.subject}"` +
-				(req.body.scope === 'global' ? ' globally.' : ` on ${req.body.domain}.`),
-			...grant,
-		});
-	}catch(error){
-		next(error);
-	}
-});
-
-router.delete('/:id', async function(req, res, next){
-	try{
-		let grant = await Grant.get(req.params.id);
-		await grant.remove();
-		return res.json({message: `Grant ${req.params.id} removed.`});
-	}catch(error){
-		next(error);
-	}
-});
-
-module.exports = router;

nodejs/routes/group.js

@@ -0,0 +1,61 @@
+'use strict';
+
+const router = require('express').Router();
+const {LocalGroup} = require('../models/local_group');
+const {reqUsername} = require('../middleware/authz');
+
+// Local-group management is admin-only; the gate is applied where this router is
+// mounted (routes/api.js).
+
+router.get('/', async function(req, res, next){
+	try{
+		return res.json({results: await LocalGroup.listDetail()});
+	}catch(error){
+		next(error);
+	}
+});
+
+router.post('/', async function(req, res, next){
+	try{
+		let group = await LocalGroup.create({
+			name: req.body.name,
+			members: Array.isArray(req.body.members) ? req.body.members : [],
+			created_by: reqUsername(req),
+		});
+		return res.json({message: `Group "${group.name}" created.`, ...group});
+	}catch(error){
+		next(error);
+	}
+});
+
+router.delete('/:name', async function(req, res, next){
+	try{
+		let group = await LocalGroup.get(req.params.name);
+		await group.remove();
+		return res.json({message: `Group "${req.params.name}" removed.`});
+	}catch(error){
+		next(error);
+	}
+});
+
+router.post('/:name/members', async function(req, res, next){
+	try{
+		let group = await LocalGroup.get(req.params.name);
+		group = await group.addMember(req.body.username);
+		return res.json({message: `Added "${req.body.username}" to "${group.name}".`, ...group});
+	}catch(error){
+		next(error);
+	}
+});
+
+router.delete('/:name/members/:username', async function(req, res, next){
+	try{
+		let group = await LocalGroup.get(req.params.name);
+		group = await group.removeMember(req.params.username);
+		return res.json({message: `Removed "${req.params.username}" from "${group.name}".`, ...group});
+	}catch(error){
+		next(error);
+	}
+});
+
+module.exports = router;

nodejs/routes/permission.js

@@ -0,0 +1,70 @@
+'use strict';
+
+const router = require('express').Router();
+const conf = require('@simpleworkjs/conf');
+const {Permission} = require('../models/permission');
+const {LocalGroup} = require('../models/local_group');
+const {User} = require('../models').models;
+const {reqUsername} = require('../middleware/authz');
+
+// All permission management is admin-only; the gate is applied where this router
+// is mounted (routes/api.js).
+
+router.get('/', async function(req, res, next){
+	try{
+		return res.json({results: await Permission.listDetail()});
+	}catch(error){
+		next(error);
+	}
+});
+
+// Autocomplete source for the "Subject" field: known usernames and group names.
+// Groups are derived (no group registry beyond local groups): local groups +
+// group-subjects already used in permissions + conf.auth admin/role-map groups.
+router.get('/subjects', async function(req, res, next){
+	try{
+		let users = (await User.list()) || [];
+
+		let groups = new Set();
+		try{
+			for(let g of await LocalGroup.list()) groups.add(g);
+		}catch(error){ /* none */ }
+		try{
+			for(let p of await Permission.listDetail()){
+				if(p.subjectType === 'group' && p.subject) groups.add(p.subject);
+			}
+		}catch(error){ /* none */ }
+		for(let g of (conf.auth && conf.auth.adminGroups) || []) groups.add(g);
+		for(let g of Object.keys((conf.auth && conf.auth.groupRoleMap) || {})) groups.add(g);
+
+		return res.json({users, groups: [...groups].sort()});
+	}catch(error){
+		next(error);
+	}
+});
+
+router.post('/', async function(req, res, next){
+	try{
+		req.body.created_by = reqUsername(req);
+		let permission = await Permission.create(req.body);
+		return res.json({
+			message: `Granted ${req.body.role} to ${req.body.subjectType} "${req.body.subject}"` +
+				(req.body.scope === 'global' ? ' globally.' : ` on ${req.body.domain}.`),
+			...permission,
+		});
+	}catch(error){
+		next(error);
+	}
+});
+
+router.delete('/:id', async function(req, res, next){
+	try{
+		let permission = await Permission.get(req.params.id);
+		await permission.remove();
+		return res.json({message: `Permission ${req.params.id} removed.`});
+	}catch(error){
+		next(error);
+	}
+});
+
+module.exports = router;

nodejs/routes/render.js

@@ -42,8 +42,16 @@ router.get('/users', async function(req, res, next) {
   res.render('users', {...values});
 });
 
-router.get('/grants', async function(req, res, next) {
-  res.render('grants', {...values});
+router.get('/permissions', async function(req, res, next) {
+  res.render('permissions', {...values});
+});
+
+router.get('/groups', async function(req, res, next) {
+  res.render('groups', {...values});
+});
+
+router.get('/profile', async function(req, res, next) {
+  res.render('profile', {...values});
 });
 
 // Bare /login (the OIDC callback redirect target) and /login/<path>.

nodejs/routes/user.js

@@ -45,7 +45,11 @@ router.get('/me', async function(req, res, next){
 		let effective = await authz.getEffective(req);
 		return res.json({
 			username: authz.reqUsername(req),
-			groups: req.groups || [],
+			// Merged groups (external + local); localGroups is the app-managed
+			// subset, externalGroups the ones from SSO/LDAP.
+			groups: effective.groups || req.groups || [],
+			localGroups: effective.localGroups || [],
+			externalGroups: req.groups || [],
 			isAdmin: effective.isAdmin,
 			global: effective.global,
 			domains: effective.domains,