7f2207bc28
Settings was missing self-service account security and any API-key UI:
- Account security (new Security tab): change password (POST /auth/change-password
— verifies current via Argon2, rejects unchanged), enable 2FA (wires the
existing /auth/2fa/setup QR + /auth/2fa/verify), and disable 2FA (new
POST /auth/2fa/disable, requires a current code so a hijacked session can't
strip the second factor).
- New API tab: create/list/revoke per-license API keys (the overnight backend
had no UI), plaintext shown once, plus an 'API docs' button to /api/docs (Swagger).
Root-cause RBAC fix — the system-default Owner role enumerated per-resource
wildcards (server.*, wipe.*, ...) and drifted: apikeys, webhooks, alerts,
analytics, chat, schedules, notifications, map, users and ALL plugin-config
modules (plus singular plugin.* vs granted plugins.*) were locked out for any
non-super-admin Owner. Owner = full control of its license:
- migration 025 sets the Owner role to {"*": true}
- PermissionsGuard honors '*' as allow-all
- frontend hasPermission honors '*' and resource.* wildcards (was exact-match
only, so wildcard-based roles silently failed)
Backend tsc + frontend build green. NOTE: migration 025 auto-applies on a fresh
DB (Saturday); the live DB needs the one-line UPDATE applied to unlock the API
tab for a non-super-admin owner.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
42 lines
1.6 KiB
TypeScript
42 lines
1.6 KiB
TypeScript
import { Injectable, CanActivate, ExecutionContext } from '@nestjs/common';
|
|
import { Reflector } from '@nestjs/core';
|
|
import { PERMISSION_KEY } from '../decorators/require-permission.decorator';
|
|
|
|
@Injectable()
|
|
export class PermissionsGuard implements CanActivate {
|
|
constructor(private reflector: Reflector) {}
|
|
|
|
canActivate(context: ExecutionContext): boolean {
|
|
const requiredPermission = this.reflector.getAllAndOverride<string>(
|
|
PERMISSION_KEY,
|
|
[context.getHandler(), context.getClass()],
|
|
);
|
|
if (!requiredPermission) return true;
|
|
|
|
const { user } = context.switchToHttp().getRequest();
|
|
if (!user) return false;
|
|
|
|
// Super admins bypass all permission checks
|
|
if (user.is_super_admin) return true;
|
|
|
|
// API keys are full programmatic access to their own license (always
|
|
// tenant-scoped by license_id via @CurrentTenant). Granted here rather than
|
|
// enumerating every permission. Future: scoped/read-only keys.
|
|
if (user.is_api_key) return true;
|
|
|
|
// Check permissions JSONB from role
|
|
const permissions = user.permissions as Record<string, boolean> | undefined;
|
|
if (!permissions) return false;
|
|
|
|
// Global wildcard — the Owner role (full control of its license) carries
|
|
// {"*": true}, so new features never need to amend the role enumeration.
|
|
if (permissions['*'] === true) return true;
|
|
|
|
// Support wildcard: "server.*" matches "server.view", "server.console", etc.
|
|
const parts = requiredPermission.split('.');
|
|
const wildcard = parts[0] + '.*';
|
|
|
|
return permissions[requiredPermission] === true || permissions[wildcard] === true;
|
|
}
|
|
}
|