theta42/proxy
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Permissions: rename Grants, add wildcards, local groups, profile

Browse Source 
- Rename Grant -> Permission end-to-end (model, routes, view, frontend,
  bootstrap) and add an idempotent redis migration for existing records.
- utils/roles.js: glob domain matching (* = one label, ** = any depth) against
  the full host; authz passes the full hostname.
- Local groups: LocalGroup model + admin routes/UI; membership merged into
  Permission.effectiveFor so app groups behave like SSO groups.
- Subject autocomplete via GET /api/permission/subjects (users + derived groups).
- User profile page (/profile) and username in the navbar; /api/user/me now
  returns merged/local/external groups.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
William Mantly
2026-07-11 10:54:15 -04:00
parent 098ff5bc9b
commit 2acc3644c4
20 changed files with 858 additions and 120 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nodejs/routes/dns.js
+3 -3
View File
@@ -3,7 +3,7 @@
const router = require('express').Router();
const {DnsProvider, Domain, DynamicRecord} = require('../models').models;
const authz = require('../middleware/authz');
const {Grant} = require('../models/grant');
const {Permission} = require('../models/permission');
const {getPublicIp} = require('../utils/public_ip');
const Model = DnsProvider;
@@ -123,7 +123,7 @@ router.post('/dynamic/:id/refresh', async function(req, res, next){
try{
let record = await DynamicRecord.get(req.params.id);
let effective = await authz.getEffective(req);
if(!Grant.allows(effective, 'manager', authz.toDomain(record.domain))){
if(!Permission.allows(effective, 'manager', authz.toDomain(record.domain))){
let error = new Error('Forbidden'); error.name = 'Forbidden'; error.status = 403;
error.message = `You need 'manager' rights on ${record.domain}.`;
throw error;
@@ -141,7 +141,7 @@ router.delete('/dynamic/:id', async function(req, res, next){
try{
let record = await DynamicRecord.get(req.params.id);
let effective = await authz.getEffective(req);
if(!Grant.allows(effective, 'manager', authz.toDomain(record.domain))){
if(!Permission.allows(effective, 'manager', authz.toDomain(record.domain))){
let error = new Error('Forbidden'); error.name = 'Forbidden'; error.status = 403;
error.message = `You need 'manager' rights on ${record.domain}.`;
throw error;