Moheeb Zara
9447b5ee80
Migration 023 (folded into schema.sql section 15). ADDITIVE and backward compatible: with no permission/ACL rows the app behaves exactly as before. Schema: - space_role_permissions (space_id, subject, permission); ops_acl (space_id, entity_type secret|kb|process|area_lead, entity_id, role). Full RLS, writes admin/board. - user_effective_roles(uid,sid): built-in role + custom-role slugs + area_lead:<id> for areas the member leads. SECURITY DEFINER. - user_has_permission(uid,sid,perm): admin implicit-all else a grant via an effective role. SECURITY DEFINER. - secrets/knowledge_base SELECT rewritten as `exact existing rule OR ops_acl match` (only widens; zero change with no ACL rows). Seed + backfill default role permissions. Area-lead roles reuse the existing area_leads table rather than duplicating the concept: a row is a role, lead_id NULL = Vacant, assigning sets lead_id, the member then holds area_lead:<id>. App: - lib/permissions-catalog.ts (codes + per-role defaults + guardrails), Zod schemas, lib/actions/permissions.ts (setRolePermissions, setOpsAcl, createAreaLeadRole, assign/unassign/delete). - Customize gains Permissions (role x permission matrix, admin shown implicit-all/locked) and Area leads (create/Vacant/assign) panels, modular under customize/panels/. Reusable components/ops/ops-acl-editor.tsx wired into the Secrets list. Audit-found latent fixes: - revealSecret errors on encrypted-but-no-ciphertext corruption instead of silently returning the stale plaintext column. - upsertAreaLead rejects null/empty area_code (NULLs are distinct in unique constraints; allowed duplicate rows). types/database.ts: added the two new tables. 271/271 tests pass, build clean. KB-modal ACL wiring + members-row shortcut deferred and tracked in HANDOFF.
87 lines
3.4 KiB
TypeScript
87 lines
3.4 KiB
TypeScript
'use client'
|
|
|
|
import { useState } from 'react'
|
|
import { RolesPanel } from './panels/roles-panel'
|
|
import { PermissionsPanel } from './panels/permissions-panel'
|
|
import { TiersPanel } from './panels/tiers-panel'
|
|
import { AreasPanel } from './panels/areas-panel'
|
|
import { AreaLeadsPanel } from './panels/area-leads-panel'
|
|
import { InvitesPanel } from './panels/invites-panel'
|
|
import { OnboardingPanel } from './panels/onboarding-panel'
|
|
import type { RoleLabelRow, CustomRole, Tier, Invite, Step, Area } from './panels/types'
|
|
|
|
type Section = 'roles' | 'permissions' | 'tiers' | 'areas' | 'area-leads' | 'invites' | 'onboarding'
|
|
|
|
const SECTIONS: { key: Section; label: string }[] = [
|
|
{ key: 'roles', label: 'Roles' },
|
|
{ key: 'permissions', label: 'Permissions' },
|
|
{ key: 'tiers', label: 'Membership tiers' },
|
|
{ key: 'areas', label: 'Areas' },
|
|
{ key: 'area-leads', label: 'Area leads' },
|
|
{ key: 'invites', label: 'Invite codes' },
|
|
{ key: 'onboarding', label: 'Onboarding' },
|
|
]
|
|
|
|
interface AreaLead {
|
|
id: string
|
|
area_code: string | null
|
|
area_name: string
|
|
lead_id: string | null
|
|
lead_handle: string | null
|
|
status: string
|
|
}
|
|
|
|
interface Props {
|
|
isAdmin: boolean
|
|
roleLabels: RoleLabelRow[]
|
|
customRoles: CustomRole[]
|
|
tiers: Tier[]
|
|
invites: Invite[]
|
|
onboardingSteps: Step[]
|
|
areas: Area[]
|
|
rolePerms: Array<{ subject: string; permission: string }>
|
|
areaLeads: AreaLead[]
|
|
members: Array<{ id: string; display_name: string | null; handle: string | null }>
|
|
}
|
|
|
|
export function CustomizeClient(props: Props) {
|
|
const [section, setSection] = useState<Section>('roles')
|
|
|
|
return (
|
|
<div className="p-4 md:p-6 max-w-6xl">
|
|
<div className="mb-6">
|
|
<h1 className="font-mono text-sm tracking-widest uppercase text-muted-foreground mb-1">Customize</h1>
|
|
<p className="font-sans text-sm text-muted-foreground">
|
|
Make the space yours. Operational settings (identity, integrations, webhooks) live under Settings.
|
|
</p>
|
|
</div>
|
|
|
|
<div className="flex flex-col md:flex-row gap-6">
|
|
<nav className="md:w-56 shrink-0 flex md:flex-col gap-1 overflow-x-auto md:overflow-visible">
|
|
{SECTIONS.map(s => (
|
|
<button
|
|
key={s.key}
|
|
onClick={() => setSection(s.key)}
|
|
className={`text-left px-3 py-2 rounded text-sm font-sans transition whitespace-nowrap ${
|
|
section === s.key ? 'bg-primary/10 text-primary' : 'text-foreground/70 hover:bg-muted hover:text-foreground'
|
|
}`}
|
|
>
|
|
{s.label}
|
|
</button>
|
|
))}
|
|
</nav>
|
|
|
|
<div className="flex-1 min-w-0">
|
|
{section === 'roles' && <RolesPanel isAdmin={props.isAdmin} roleLabels={props.roleLabels} customRoles={props.customRoles} />}
|
|
{section === 'permissions' && <PermissionsPanel isAdmin={props.isAdmin} customRoles={props.customRoles} rolePerms={props.rolePerms} />}
|
|
{section === 'tiers' && <TiersPanel isAdmin={props.isAdmin} tiers={props.tiers} />}
|
|
{section === 'areas' && <AreasPanel isAdmin={props.isAdmin} areas={props.areas} />}
|
|
{section === 'area-leads' && <AreaLeadsPanel isAdmin={props.isAdmin} areaLeads={props.areaLeads} members={props.members} />}
|
|
{section === 'invites' && <InvitesPanel isAdmin={props.isAdmin} invites={props.invites} />}
|
|
{section === 'onboarding' && <OnboardingPanel isAdmin={props.isAdmin} steps={props.onboardingSteps} />}
|
|
</div>
|
|
</div>
|
|
</div>
|
|
)
|
|
}
|