feature/org-rbac-groups #6

Merged

mhahl merged 17 commits from feature/org-rbac-groups into main

2026-08-09 05:52:52 +00:00

mhahl commented

2026-08-09 05:52:48 +00:00

Owner

No description provided.

mhahl added 17 commits

2026-08-09 05:52:48 +00:00

Add optional reveal-access approval workflow with time-limited grants. 3c0a6da99c

Project default and per-secret overrides gate human reveals behind admin
approval (machine tokens/ESO stay exempt). UI uses oat dialog/dropdown,
Access tab/inbox, and human-readable grant expiry; PAT/CLI endpoints and
docs cover request, list, approve, and deny.

Use white badges with black counts for access-request indicators. a189080152

Improves contrast for pending counts in the project Access tab and
Administration sidebar link.

Right-align access-request count badges in the sidebar. a3666ddcd3

Uses flex layout on side nav links so the pending badge sits on the
trailing edge of the row.

Add per-secret ACLs to restrict access within a project. 52cdb762aa

Secrets can require writers, admins, team owners, or a custom user allow-list
instead of full project membership. Enforced via api.can_access_secret in RLS,
with UI controls on create/view and documentation.

Merge per-secret ACLs into cli-full-mgmt. f423772168

Combines restricted secret access modes (writers/admins/owners/custom)
with the existing reveal-approval workflow. Resolve conflicts so both
acl_mode and requires_approval apply under project RBAC and RLS.

feat: org RBAC with team-scoped groups (LDAP/OIDC/manual) 33146a4e35

Team groups map to team roles, project roles, and secret ACL grants.
Directory login syncs group_members via external_key. Docs, seed_mock,
and unit tests updated.

fix: drop secret_acl_rows before recreate (return type change) 3475fd94da

CREATE OR REPLACE cannot change OUT columns; DROP first so ensure_schema
applies group-aware ACL row shape on existing volumes.

fix: align early secret_acl_rows with group-aware return type 9461356f58

Earlier ensure_schema stmt still created the user-only OUT signature and
failed after groups migration. Drop + recreate with group columns first.

docs: organisation RBAC setup and usage guide c034b4a97a

Add docs/rbac.md (roles, groups, LDAP/OIDC, project/secret grants, recipes)
and link from README, deploy, authentication, and api docs.

ui: move secret custom access list to Access tab 7b8f76b801

Secret full view uses Secret | Access tabs for project admins. ACL mode and
user/group grants live on Access; value save no longer resets acl_mode.

docs: Access tab steps for secret ACL a098cd30be

fix: secret RLS for INSERT RETURNING via can_access_secret_row a4b13c5948

can_access_secret re-queried api.secrets, so the new row was invisible
during INSERT … RETURNING and RLS failed. Policies now use row columns
via can_access_secret_row; can_access_secret remains the app-facing API.

ui: move reveal approval to Access tab; rename Cancel to Back 7a724af8ab

Access settings form now saves ACL mode and requires_approval together.
Secret value save no longer touches those fields.

ui: link project Group roles to team Groups tab 17c8f27e31

fix: ACL reveal checks, export filter, permissions UX e704389c7d

- can_reveal_secret requires can_access_secret(reveal) before approval
- plain/bulk export only include secrets caller may reveal
- ESO/PAT distinguishes forbidden (ACL) vs approval_required
- secret Permissions tab rename; read-only ACL guidance; project.html fix
- tests for ACL modes, routes, export, ESO order

fix: PAT bulk export ACL filter; groups cannot be team owner 236402eedd

- ESO/PAT list-with-values requires can_access_secret(reveal)+can_reveal
- groups.team_role limited to admin/member/viewer (migrate owner→admin)
- Behavioral ACL matrix tests + bulk-export filter tests

ux: align ACL labels, machine tab, dialogs, and create-form defaults c05ccdd26a

- Inline create uses config ACL labels and project approval default state
- Machine tokens tab → Machine accounts; Permissions heading matches tab
- Access-request pending dialog: Request submitted / Done consistently
- owners label; restricted badge titles; delete confirm; Create button
- Global inbox note; secrets partial gets acl_mode_labels

mhahl merged commit 3d5d4e2179 into main

2026-08-09 05:52:52 +00:00

mhahl referenced this pull request from a commit

2026-08-09 05:52:53 +00:00

Merge pull request 'feature/org-rbac-groups' (#6) from feature/org-rbac-groups into main