Claude Opus 4.8
406886c56c
Some checks failed
CD / Build and push images (push) Successful in 3m5s
CI / Lint, typecheck, test (push) Successful in 2m31s
CI / Auth e2e pack (push) Failing after 2m0s
CI / Build container images (push) Has been skipped
CD / Deploy to Test (push) Successful in 9s
CD / Smoke tests against Test (push) Successful in 1m14s
CD / Promote to Int (push) Successful in 12s
Pond Admins configure the vision's fine-grained cases through a plain-language surface, on top of the base roles from #54. - shared: `AccessRuleView` (a grant enriched with subject/scope display names) and pure conflict helpers `scopeSpecificity`/`sameGrantSubject`/ `isRuleShadowed` (unit-tested) for the client-side shadowed-rule hint. New `access` i18n namespace (de+en) with sentence templates (ADR 0012). - api: `GET /ponds/:id/grants/access-rules` (Pond-Admin) returns the pond's grants enriched with each user's display name and each label/page scope's name, resolved in one batched query per kind. - web `access/`: `AccessRulesManager` in Pond Settings — the pond's rules grouped by subject and rendered as readable de/en sentences ("Anna may not edit pages labeled “Confidential”"), an add form (subject = member or the `signed-in`/`public` pseudo-subjects; scope = label from the tree or a specific page; role; allow/deny) that warns when a rule would be shadowed by a more specific existing one (shared algorithm) and requires an explicit confirmation before granting anything to `public`. Semantics are the shared resolver's — the UI only reflects permissions.md. - tests: shared `conflicts.test.ts`; an api db case for the enriched endpoint; a browser `access-rules` pack that configures BOTH vision patterns through the UI and verifies their effect end to end — "deny label X" (an editor loses a labelled page) and "only label Y" (a signed-in non-member, new `fixture-viewer`, reads only the labelled pages) — plus the shadow hint and the public confirmation, with its own CI step. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1
43 lines
1.5 KiB
JSON
43 lines
1.5 KiB
JSON
{
|
|
"title": "Zugriffsregeln",
|
|
"description": "Feingranulare Regeln zusätzlich zu den Basisrollen. Die spezifischere Regel gewinnt: eine Regel auf einer Seite schlägt eine auf einem Label, und die schlägt eine für den ganzen Teich.",
|
|
"subject": {
|
|
"user": "{{name}}",
|
|
"authenticated": "Angemeldete Personen",
|
|
"public": "Alle (öffentlich)"
|
|
},
|
|
"ability": {
|
|
"reader": "lesen",
|
|
"editor": "bearbeiten",
|
|
"pond_admin": "verwalten"
|
|
},
|
|
"scope": {
|
|
"pond": "alles in diesem Teich",
|
|
"label": "Seiten mit dem Label „{{name}}“",
|
|
"page": "die Seite „{{name}}“"
|
|
},
|
|
"sentence": {
|
|
"allow": "{{subject}} darf {{scope}} {{ability}}.",
|
|
"deny": "{{subject}} darf {{scope}} nicht {{ability}}."
|
|
},
|
|
"noRules": "Noch keine Regeln — es gelten nur die Basisrollen.",
|
|
"add": {
|
|
"title": "Regel hinzufügen",
|
|
"subject": "Wer",
|
|
"scopeType": "Wo",
|
|
"scopeLabel": "Label",
|
|
"scopePage": "Seite",
|
|
"role": "Recht",
|
|
"effect": "Wirkung",
|
|
"allow": "Erlauben",
|
|
"deny": "Verbieten",
|
|
"submit": "Regel hinzufügen",
|
|
"pickScope": "Wähle ein Label oder eine Seite.",
|
|
"shadowedWarning": "Eine spezifischere Regel für dieses Subjekt entscheidet hier bereits das Gegenteil — diese Regel bleibt womöglich wirkungslos.",
|
|
"publicWarning": "Damit werden Inhalte für alle im Internet sichtbar. Bist du sicher?",
|
|
"publicConfirm": "Ja, öffentlich machen"
|
|
},
|
|
"remove": "Entfernen",
|
|
"loadError": "Zugriffsregeln konnten nicht geladen werden."
|
|
}
|