gsadmin/sencho
1
0
Fork 0
mirror of https://github.com/Studio-Saelix/sencho.git synced 2026-08-28 19:27:41 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(rbac): add Deployer & Node Admin roles with scoped permissions (Team Pro) (#253)

Browse Source 
* feat(rbac): add Deployer & Node Admin roles with scoped permissions (Team Pro)

Add intermediate RBAC roles gated to Team Pro tier:
- Deployer: can deploy/restart/stop/start stacks but cannot edit compose files, delete stacks, or access system settings
- Node Admin: full stack and node management within scope, no system settings access
- Scoped permissions: assign roles per-stack or per-node for fine-grained access control
- Permission engine with checkPermission/requirePermission guards replacing requireAdmin on stack/node routes
- Frontend can() function with /api/permissions/me endpoint for client-side permission checks
- User management UI updated with 4-role selector and scoped permission editor
- Documentation updated with permission matrix, scoped permission docs, and screenshots

* fix(rbac): remove unused RoleAssignment import to fix lint error
This commit is contained in:
Anso
2026-03-29 17:02:56 -04:00
committed by GitHub
parent 37701d5281
commit 8380fbad4b
10 changed files with 636 additions and 88 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+14
View File
@@ -4,6 +4,20 @@ All notable changes to this project will be documented in this file.
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
## [Unreleased]
### Added
* **rbac:** introduce Deployer and Node Admin intermediate roles with scoped permissions (Team Pro)
- Deployer role: can deploy, restart, stop, and start stacks but cannot edit compose files, delete stacks, or access system settings
- Node Admin role: full stack and node management but no system settings, user management, or license access
- Scoped permissions: assign roles per stack or per node for fine-grained access control
- Permission matrix engine with `checkPermission()` for consistent backend enforcement
- Frontend `can()` function in AuthContext for consistent UI guards
- New API endpoints: `GET/POST/DELETE /api/users/:id/roles` for managing scoped assignments
- New API endpoint: `GET /api/permissions/me` for fetching effective permissions
- Gated to Team Pro tier — Community and Personal Pro retain binary Admin/Viewer roles
## [0.17.0](https://github.com/AnsoCode/Sencho/compare/v0.16.0...v0.17.0) (2026-03-29)