7f2207bc28
Settings was missing self-service account security and any API-key UI:
- Account security (new Security tab): change password (POST /auth/change-password
— verifies current via Argon2, rejects unchanged), enable 2FA (wires the
existing /auth/2fa/setup QR + /auth/2fa/verify), and disable 2FA (new
POST /auth/2fa/disable, requires a current code so a hijacked session can't
strip the second factor).
- New API tab: create/list/revoke per-license API keys (the overnight backend
had no UI), plaintext shown once, plus an 'API docs' button to /api/docs (Swagger).
Root-cause RBAC fix — the system-default Owner role enumerated per-resource
wildcards (server.*, wipe.*, ...) and drifted: apikeys, webhooks, alerts,
analytics, chat, schedules, notifications, map, users and ALL plugin-config
modules (plus singular plugin.* vs granted plugins.*) were locked out for any
non-super-admin Owner. Owner = full control of its license:
- migration 025 sets the Owner role to {"*": true}
- PermissionsGuard honors '*' as allow-all
- frontend hasPermission honors '*' and resource.* wildcards (was exact-match
only, so wildcard-based roles silently failed)
Backend tsc + frontend build green. NOTE: migration 025 auto-applies on a fresh
DB (Saturday); the live DB needs the one-line UPDATE applied to unlock the API
tab for a non-super-admin owner.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
16 lines
840 B
SQL
16 lines
840 B
SQL
-- 025_owner_full_access.sql
|
|
--
|
|
-- The system-default Owner role enumerated per-resource wildcards
|
|
-- (server.*, wipe.*, players.*, ...). Every feature added since drift past that
|
|
-- enumeration: apikeys, webhooks, alerts, analytics, chat, schedules,
|
|
-- notifications, map, users, and ALL plugin-config modules (plus a singular
|
|
-- 'plugin.*' vs granted 'plugins.*' mismatch) were silently locked out for any
|
|
-- non-super-admin Owner — PermissionsGuard denies a permission the role doesn't
|
|
-- grant. The Owner has "full control of their license" by definition, so grant
|
|
-- a global wildcard instead of an enumeration that must be amended per feature.
|
|
--
|
|
-- PermissionsGuard and the frontend auth store both honor "*" as allow-all.
|
|
UPDATE roles
|
|
SET permissions = '{"*": true}'::jsonb
|
|
WHERE role_name = 'Owner' AND is_system_default = true;
|