mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-10-24 12:42:49 +00:00
rcourtman
4d47504331
A provider opening a client workspace from the Pulse Account portal arrives in that client's organization as its owner. ensureAdminSession admits an org manager to the org-bound settings routes, but the security status snapshot reported every settings capability as false for any org-scoped session. Since the Settings navigation started hiding gated panels in August, the owner saw only General: no Infrastructure page to connect the client's Proxmox or install agents, and no Reporting page for the client reports. The portal's handoff to /settings/infrastructure fell through to General. Found on a fresh v6.4.1 provider bundle, where /api/config/nodes answered 200 for the same session that /api/security/status said could reach nothing. Route and snapshot now share one settings-admin rule, sessionUserHasSettingsAdminPrivileges. The snapshot keeps it out of sessionIsAdmin: it widens only infrastructureRead, availabilityRead and reportingRead, whose handlers read the organization's own config and monitor state. Instance administration, detailLevel, authUsername and billingAdmin stay withheld from org-scoped sessions, as the scoped local session contract requires.