-
-
+
+
+
+
+
+
+
{secret.title}
+ {secret.area &&
{secret.area}
}
+ {revealed && value && (
+
{value}
+ )}
+
+
+ {canManageAcl && (
+
+ )}
+
+
+
+ {showAcl && canManageAcl && (
+
+ )}
)
}
@@ -504,7 +534,7 @@ function KbEntryRow({
}
// ─── Main Component ────────────────────────────────────────────────────────────
-export function OpsClient({ member, spaceId, kbEntries: initial, areaLeads: initialLeads, secrets: initialSecrets, canSeeSecrets }: Props) {
+export function OpsClient({ member, spaceId, kbEntries: initial, areaLeads: initialLeads, secrets: initialSecrets, canSeeSecrets, canManageAcl = false, aclRoleOptions = [], aclByEntity = {} }: Props) {
const router = useRouter()
const [activeTab, setActiveTab] = useState
('kb')
const [search, setSearch] = useState('')
@@ -722,7 +752,14 @@ export function OpsClient({ member, spaceId, kbEntries: initial, areaLeads: init
) : filteredSecrets.length > 0 ? (
{filteredSecrets.map(s => (
- setSecrets(prev => prev.filter(x => x.id !== id))} />
+ setSecrets(prev => prev.filter(x => x.id !== id))}
+ canManageAcl={canManageAcl}
+ aclRoleOptions={aclRoleOptions}
+ aclInitial={aclByEntity[`secret:${s.id}`] ?? []}
+ />
))}
) : (
diff --git a/app/(app)/ops/page.tsx b/app/(app)/ops/page.tsx
index b566660..8ed391c 100644
--- a/app/(app)/ops/page.tsx
+++ b/app/(app)/ops/page.tsx
@@ -12,8 +12,9 @@ export default async function OpsPage() {
if (!member) return null
const canSeeSecrets = member.role === 'admin' || member.role === 'board'
+ const canManageAcl = member.role === 'admin' || member.role === 'board'
- const [{ data: kbEntries }, { data: areaLeads }, secretsResult] = await Promise.all([
+ const [{ data: kbEntries }, { data: areaLeads }, secretsResult, { data: customRoles }, { data: acl }] = await Promise.all([
supabase.from('knowledge_base').select('*').eq('space_id', member.space_id).order('is_pinned', { ascending: false }).order('created_at', { ascending: false }),
supabase.from('area_leads').select('*').eq('space_id', member.space_id).order('area_name'),
canSeeSecrets
@@ -22,8 +23,26 @@ export default async function OpsPage() {
// through the revealSecret() server action.
? supabase.from('secrets').select('id, title, area, created_at, label, description, icon, space_id, created_by, updated_at, category, notes, encryption_version').eq('space_id', member.space_id)
: Promise.resolve({ data: [] as Tables<'secrets'>[] }),
+ supabase.from('space_custom_roles').select('slug, name').eq('space_id', member.space_id),
+ supabase.from('ops_acl').select('entity_type, entity_id, role').eq('space_id', member.space_id),
])
+ // Selectable ACL roles: built-in roles, custom-role slugs, and area-lead
+ // sentinels labelled by area name.
+ const aclRoleOptions = [
+ { value: 'treasurer', label: 'treasurer' },
+ { value: 'member', label: 'member' },
+ { value: 'associate', label: 'associate' },
+ ...((customRoles ?? []).map(c => ({ value: c.slug, label: c.name }))),
+ ...((areaLeads ?? []).map(al => ({ value: `area_lead:${al.id}`, label: `${al.area_name} lead` }))),
+ ]
+
+ const aclByEntity: Record = {}
+ for (const row of acl ?? []) {
+ const k = `${row.entity_type}:${row.entity_id}`
+ ;(aclByEntity[k] ??= []).push(row.role)
+ }
+
return (
}
@@ -32,6 +51,9 @@ export default async function OpsPage() {
areaLeads={areaLeads ?? []}
secrets={secretsResult.data ?? []}
canSeeSecrets={canSeeSecrets}
+ canManageAcl={canManageAcl}
+ aclRoleOptions={aclRoleOptions}
+ aclByEntity={aclByEntity}
/>
)
}
diff --git a/components/ops/ops-acl-editor.tsx b/components/ops/ops-acl-editor.tsx
new file mode 100644
index 0000000..3473ac0
--- /dev/null
+++ b/components/ops/ops-acl-editor.tsx
@@ -0,0 +1,74 @@
+'use client'
+
+import { useState } from 'react'
+import { toast } from 'sonner'
+import { setOpsAcl } from '@/lib/actions'
+
+export interface AclRoleOption { value: string; label: string }
+
+interface Props {
+ entityType: 'secret' | 'kb' | 'process'
+ entityId: string
+ options: AclRoleOption[]
+ initial: string[]
+}
+
+// Toggling roles here writes ops_acl. An empty selection means the item
+// falls back to its default visibility (admin/board for secrets; the
+// visibility column for KB). Selecting roles WIDENS read access to those
+// roles in addition to the default.
+export function OpsAclEditor({ entityType, entityId, options, initial }: Props) {
+ const [selected, setSelected] = useState>(new Set(initial))
+ const [saving, setSaving] = useState(false)
+
+ async function toggle(value: string, on: boolean) {
+ const next = new Set(selected)
+ if (on) next.add(value)
+ else next.delete(value)
+ setSelected(next)
+ setSaving(true)
+ const result = await setOpsAcl({ entity_type: entityType, entity_id: entityId, roles: Array.from(next) })
+ setSaving(false)
+ if (result.error) {
+ toast.error(result.error)
+ setSelected(prev => {
+ const back = new Set(prev)
+ if (on) back.delete(value)
+ else back.add(value)
+ return back
+ })
+ }
+ }
+
+ return (
+
+
+ Who can access {saving && …}
+
+ {options.length === 0 ? (
+
No roles available.
+ ) : (
+
+ {options.map(o => {
+ const on = selected.has(o.value)
+ return (
+
+ )
+ })}
+
+ )}
+
+ Admins and board always have access. Empty selection keeps the default visibility.
+
+