Claude Opus 4.8
f5f1310eb2
All checks were successful
CD / Build and push images (push) Successful in 3m14s
CI / Lint, typecheck, test (push) Successful in 2m31s
CI / Auth e2e pack (push) Successful in 3m21s
CI / Build container images (push) Has been skipped
CD / Deploy to Test (push) Successful in 9s
CD / Smoke tests against Test (push) Successful in 1m12s
CD / Promote to Int (push) Successful in 11s
Pond Admins can answer "what can X actually see/do here?" — load-bearing for trust in the grant system (permissions.md §UI obligations). - shared: `explainPageCapability` — the resolver's decision chain (deciding level + the single deciding grant), sharing one code path with the boolean `resolvePageCapability` (now a thin wrapper), so the trace can never diverge from real access. Unit-tested against the permissions.md worked examples. - api: `GET /ponds/:id/effective-permissions?subjectType=&subjectId=&pageId=` (Pond-Admin-gated, one pond only) resolves as the chosen subject (a user with their real Site-Admin flag, all signed-in users, or the public), optionally against a page, and returns the read + write outcome with the deciding rule enriched with subject/scope names. - web: `EffectivePermissionsInspector` in Pond Settings — pick a subject and optionally a page → see the resolved read/edit verdict, the level that decided it, and the deciding rule spelled out as a de/en sentence (reusing the #55 sentence renderer). Hidden from non-admins. - tests: explain-mode unit tests (worked examples + trace-matches-boolean); `inspector.e2e.db.test.ts` (deciding rule on a labelled page, pond-level base capability, public default-closed, Pond-Admin gating); a browser assertion in the access-rules pack. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1
60 lines
2.0 KiB
JSON
60 lines
2.0 KiB
JSON
{
|
|
"title": "Access rules",
|
|
"description": "Fine-grained rules on top of the base roles. More specific rules win: a rule on a page beats one on a label, which beats one on the whole pond.",
|
|
"subject": {
|
|
"user": "{{name}}",
|
|
"authenticated": "Signed-in users",
|
|
"public": "Everyone (public)"
|
|
},
|
|
"ability": {
|
|
"reader": "read",
|
|
"editor": "edit",
|
|
"pond_admin": "administer"
|
|
},
|
|
"scope": {
|
|
"pond": "everything in this pond",
|
|
"label": "pages labeled “{{name}}”",
|
|
"page": "the page “{{name}}”"
|
|
},
|
|
"sentence": {
|
|
"allow": "{{subject}} may {{ability}} {{scope}}.",
|
|
"deny": "{{subject}} may not {{ability}} {{scope}}."
|
|
},
|
|
"noRules": "No rules yet — only the base roles apply.",
|
|
"add": {
|
|
"title": "Add a rule",
|
|
"subject": "Who",
|
|
"scopeType": "Where",
|
|
"scopeLabel": "Label",
|
|
"scopePage": "Page",
|
|
"role": "Ability",
|
|
"effect": "Effect",
|
|
"allow": "Allow",
|
|
"deny": "Deny",
|
|
"submit": "Add rule",
|
|
"pickScope": "Choose a label or page.",
|
|
"shadowedWarning": "A more specific rule for this subject already decides the opposite here — this rule may have no effect.",
|
|
"publicWarning": "This makes content visible to everyone on the internet. Are you sure?",
|
|
"publicConfirm": "Yes, make it public"
|
|
},
|
|
"remove": "Remove",
|
|
"loadError": "Access rules could not be loaded.",
|
|
"inspector": {
|
|
"title": "Effective permissions",
|
|
"description": "Check what a person, all signed-in users, or the public can actually do here.",
|
|
"subject": "Who",
|
|
"page": "On page (optional)",
|
|
"wholePond": "The whole pond",
|
|
"read": "Read",
|
|
"write": "Edit",
|
|
"outcome": { "allow": "Allowed", "deny": "Denied" },
|
|
"decidedBy": {
|
|
"site-admin": "Site Admin — bypasses all rules",
|
|
"page": "decided by a page-level rule",
|
|
"label": "decided by a label-level rule",
|
|
"pond": "decided by a pond-level rule",
|
|
"default": "no rule grants this (default: denied)"
|
|
}
|
|
}
|
|
}
|