Claude Opus 4.8
406886c56c
Some checks failed
CD / Build and push images (push) Successful in 3m5s
CI / Lint, typecheck, test (push) Successful in 2m31s
CI / Auth e2e pack (push) Failing after 2m0s
CI / Build container images (push) Has been skipped
CD / Deploy to Test (push) Successful in 9s
CD / Smoke tests against Test (push) Successful in 1m14s
CD / Promote to Int (push) Successful in 12s
Pond Admins configure the vision's fine-grained cases through a plain-language surface, on top of the base roles from #54. - shared: `AccessRuleView` (a grant enriched with subject/scope display names) and pure conflict helpers `scopeSpecificity`/`sameGrantSubject`/ `isRuleShadowed` (unit-tested) for the client-side shadowed-rule hint. New `access` i18n namespace (de+en) with sentence templates (ADR 0012). - api: `GET /ponds/:id/grants/access-rules` (Pond-Admin) returns the pond's grants enriched with each user's display name and each label/page scope's name, resolved in one batched query per kind. - web `access/`: `AccessRulesManager` in Pond Settings — the pond's rules grouped by subject and rendered as readable de/en sentences ("Anna may not edit pages labeled “Confidential”"), an add form (subject = member or the `signed-in`/`public` pseudo-subjects; scope = label from the tree or a specific page; role; allow/deny) that warns when a rule would be shadowed by a more specific existing one (shared algorithm) and requires an explicit confirmation before granting anything to `public`. Semantics are the shared resolver's — the UI only reflects permissions.md. - tests: shared `conflicts.test.ts`; an api db case for the enriched endpoint; a browser `access-rules` pack that configures BOTH vision patterns through the UI and verifies their effect end to end — "deny label X" (an editor loses a labelled page) and "only label Y" (a signed-in non-member, new `fixture-viewer`, reads only the labelled pages) — plus the shadow hint and the public confirmation, with its own CI step. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1
43 lines
1.4 KiB
JSON
43 lines
1.4 KiB
JSON
{
|
|
"title": "Access rules",
|
|
"description": "Fine-grained rules on top of the base roles. More specific rules win: a rule on a page beats one on a label, which beats one on the whole pond.",
|
|
"subject": {
|
|
"user": "{{name}}",
|
|
"authenticated": "Signed-in users",
|
|
"public": "Everyone (public)"
|
|
},
|
|
"ability": {
|
|
"reader": "read",
|
|
"editor": "edit",
|
|
"pond_admin": "administer"
|
|
},
|
|
"scope": {
|
|
"pond": "everything in this pond",
|
|
"label": "pages labeled “{{name}}”",
|
|
"page": "the page “{{name}}”"
|
|
},
|
|
"sentence": {
|
|
"allow": "{{subject}} may {{ability}} {{scope}}.",
|
|
"deny": "{{subject}} may not {{ability}} {{scope}}."
|
|
},
|
|
"noRules": "No rules yet — only the base roles apply.",
|
|
"add": {
|
|
"title": "Add a rule",
|
|
"subject": "Who",
|
|
"scopeType": "Where",
|
|
"scopeLabel": "Label",
|
|
"scopePage": "Page",
|
|
"role": "Ability",
|
|
"effect": "Effect",
|
|
"allow": "Allow",
|
|
"deny": "Deny",
|
|
"submit": "Add rule",
|
|
"pickScope": "Choose a label or page.",
|
|
"shadowedWarning": "A more specific rule for this subject already decides the opposite here — this rule may have no effect.",
|
|
"publicWarning": "This makes content visible to everyone on the internet. Are you sure?",
|
|
"publicConfirm": "Yes, make it public"
|
|
},
|
|
"remove": "Remove",
|
|
"loadError": "Access rules could not be loaded."
|
|
}
|