feat(oidc): add fine grained access control (#91)

* feat(access-control): fine grain tokens

* fix(docs): clean wording

* test(access-control): add tests for team extraction from access tokens and bucket info permissions

* test(vocabulary): add test for ExpandGlob function to reject non-glob patterns

* feat(helm): add multi-user access control documentation and schema support

frontend/src/pages/BucketObjects.tsx

@@ -2,12 +2,20 @@ import { useEffect, useRef, useState } from 'react';
 import { useNavigate, useParams, useSearchParams } from 'react-router-dom';
 import { ObjectBrowserView } from '@/components/buckets/ObjectBrowserView';
 import { useBucketObjects } from '@/hooks/useBucketObjects';
+import { useBuckets } from '@/hooks/useApi';
+import { useBucketCan } from '@/hooks/usePermissions';
 
 export function BucketObjects() {
   const { bucketName = '' } = useParams<{ bucketName: string }>();
   const navigate = useNavigate();
   const [searchParams, setSearchParams] = useSearchParams();
 
+  const { data: buckets = [] } = useBuckets();
+  const bucket = buckets.find((b) => b.name === bucketName);
+  const canBucket = useBucketCan();
+  const canWrite = canBucket(bucket, 'object.write');
+  const canDelete = canBucket(bucket, 'object.delete');
+
   const [currentPath, setCurrentPath] = useState(searchParams.get('prefix') ?? '');
   const [searchQuery, setSearchQuery] = useState('');
   const [deepSearch, setDeepSearch] = useState(false);
@@ -79,10 +87,12 @@ export function BucketObjects() {
   // CustomEvent bridge for the Upload button in BucketDetailShell hero.
   const uploadInputRef = useRef<HTMLInputElement>(null);
   useEffect(() => {
-    const handler = () => uploadInputRef.current?.click();
+    const handler = () => {
+      if (canWrite) uploadInputRef.current?.click();
+    };
     document.addEventListener('bucket:upload', handler);
     return () => document.removeEventListener('bucket:upload', handler);
-  }, []);
+  }, [canWrite]);
 
   return (
     <>
@@ -112,11 +122,11 @@ export function BucketObjects() {
         onDeepSearchChange={setDeepSearch}
         onNavigateToFolder={handleNavigateToFolder}
         onBackToBuckets={handleBackToBuckets}
-        onUploadFiles={uploadFiles}
+        onUploadFiles={canWrite ? uploadFiles : undefined}
         uploadTasks={uploadTasks}
-        onDeleteObject={deleteObject}
-        onDeleteMultipleObjects={deleteMultipleObjects}
-        onCreateDirectory={createDirectory}
+        onDeleteObject={canDelete ? deleteObject : undefined}
+        onDeleteMultipleObjects={canDelete ? deleteMultipleObjects : undefined}
+        onCreateDirectory={canWrite ? createDirectory : undefined}
         onRefresh={handleRefresh}
         onPageChange={handlePageChange}
         onItemsPerPageChange={handleItemsPerPageChange}