feat(rbac): add Deployer & Node Admin roles with scoped permissions (Team Pro) (#253)

Browse Source

* feat(rbac): add Deployer & Node Admin roles with scoped permissions (Team Pro)

Add intermediate RBAC roles gated to Team Pro tier:
- Deployer: can deploy/restart/stop/start stacks but cannot edit compose files, delete stacks, or access system settings
- Node Admin: full stack and node management within scope, no system settings access
- Scoped permissions: assign roles per-stack or per-node for fine-grained access control
- Permission engine with checkPermission/requirePermission guards replacing requireAdmin on stack/node routes
- Frontend can() function with /api/permissions/me endpoint for client-side permission checks
- User management UI updated with 4-role selector and scoped permission editor
- Documentation updated with permission matrix, scoped permission docs, and screenshots

* fix(rbac): remove unused RoleAssignment import to fix lint error

...

This commit is contained in:

Anso

2026-03-29 17:02:56 -04:00

committed by GitHub

parent 37701d5281

commit 8380fbad4b

10 changed files with 636 additions and 88 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

docs/images/rbac/role-selector-dropdown.png

BIN

Binary file not shown.

Side by Side After Width:  |  Height:  |  Size: 81 KiB

docs/images/rbac/role-selector.png

BIN

Binary file not shown.

Side by Side After Width:  |  Height:  |  Size: 82 KiB