ui-changes #7

Merged

mhahl merged 10 commits from ui-changes into main

2026-08-09 09:28:22 +00:00

mhahl commented

2026-08-09 09:28:18 +00:00

Owner

No description provided.

mhahl added 10 commits

2026-08-09 09:28:18 +00:00

ui: align templates with oat.ink components df7bff217f

Prefer oat.ink primitives over bespoke widgets:
- badges (.badge + data-variant) for roles, kinds, due, ACL, access status
- buttons (.button / outline / small / data-variant) instead of btn-*
- alerts (role=alert) for Flask flashes; ot.toast for copy toasts
- breadcrumb as semantic nav+ol; pagination as menu.buttons
- drop custom toast host and large btn-* CSS

Keep custom only where oat cannot cover: app shell/sidebar, secret
reveal UX, and server-side ?tab= section tabs (ot-tabs is client-panel
only). Dropdowns already used ot-dropdown.

ui: match secret kind chips to overdue badge style eea7707d74

Use solid oat .badge + data-variant for kind labels (secondary /
warning / success) instead of outline + custom kind-badge CSS, same
visual language as overdue/expiring chips.

fix: make sidebar team switch update secrets/list views c52bdaf35e

Two issues made switching team look like a no-op:
1. List views read session team_id before inject_nav set it, so
   /secrets often rendered empty while the switcher looked selected.
2. From a project secrets URL, select-team redirected back to the same
   project (other team), so content never changed.

ensure_active_team() on team-scoped lists; rewrite next to /secrets (or
/projects|/machines) when the project is not on the new team; pass
full_path as next so ?tab=secrets is considered.

fix: style disabled pager Prev/Next as real oat buttons 2b301f6bbd

Use native <button disabled class="outline small"> at the ends instead
of unstyled spans so first/last page controls match active page buttons.

fix: close PostgREST RBAC gaps (H1, M1, L1–L6) ddfe0695f7

H1: projects_update requires can_admin_project (members cannot toggle
    require_reveal_approval via API).
M1: team_members insert/update WITH CHECK only owners set role=owner;
    UI/CLI/PAT guards match.
L1: secret_versions insert policy removed; archive trigger is SECURITY
    DEFINER with fixed search_path; REVOKE write from authenticated.
L2: secret_acl insert/update require group on same team as project.
L3–L6: user_directory revokes, FORCE RLS on sensitive tables, harden
    lookup_user search_path, machine-token ACL exemption docs.

feat: paginate team secrets, projects list, and global search 5bc2ce6261

H1: /secrets uses page_window with filters (project, kind, expiry, ACL)
    and showing N–M of T counts.
H2: /search reports section totals, preview caps, and scope= view-all
    pages with pagination; secret scope supports kind/due filters.
H3: /projects adds search, pagination, and a secret count column.

feat: per-token secret key allow-list (exact + globs) ef0c110297

Machine tokens may optionally list allowed secret keys and/or shell-style
globs (prod/*, DB_?). Empty allow-list keeps full project access.

- api.machine_token_scope (B1 secret_key / B2 key_pattern)
- private.machine_key_allowed + glob_to_like enforced on get/list/upsert/delete
- UI scope textarea on token create; scope column on token list
- PAT create token accepts scope/scopes array or newline string
- Docs: scoped tokens return empty/404 for out-of-scope keys

ui: modernise machine account key allow-list 35d69bd890

Replace the multiline textarea with a card create form: role switch for
restrict keys, oat ot-taginput chips, quick-add presets and project key
suggestions, and a card grid for existing tokens with badge scopes.

ui: widen machine account form; table list for tokens 9ed64275e3

Drop the nested "New machine account" heading (page title is enough),
let the create card span full width, and restore active tokens as a
standard table with scope badges.

test: convert unit suite to pytest and run via tox 873d87595f

- Rewrite app/test_app.py for pytest (setup_method, plain asserts, pytest.raises)
- Add conftest fixtures, pytest.ini, and tox -e py (mocked DB, fast-fail DSN)
- Cover paging, machine token scopes, FORCE RLS, create-token scopes
- Fix login/register mocks for TOTP; align RBAC/trash/PAT/LDAP tests with current code
- Loosen psycopg pin for CPython 3.14 wheels; drop unused token-card CSS

mhahl merged commit a4824618db into main

2026-08-09 09:28:22 +00:00

mhahl referenced this pull request from a commit

2026-08-09 09:28:23 +00:00

Merge pull request 'ui-changes' (#7) from ui-changes into main