Moheeb Zara
9447b5ee80
Migration 023 (folded into schema.sql section 15). ADDITIVE and backward compatible: with no permission/ACL rows the app behaves exactly as before. Schema: - space_role_permissions (space_id, subject, permission); ops_acl (space_id, entity_type secret|kb|process|area_lead, entity_id, role). Full RLS, writes admin/board. - user_effective_roles(uid,sid): built-in role + custom-role slugs + area_lead:<id> for areas the member leads. SECURITY DEFINER. - user_has_permission(uid,sid,perm): admin implicit-all else a grant via an effective role. SECURITY DEFINER. - secrets/knowledge_base SELECT rewritten as `exact existing rule OR ops_acl match` (only widens; zero change with no ACL rows). Seed + backfill default role permissions. Area-lead roles reuse the existing area_leads table rather than duplicating the concept: a row is a role, lead_id NULL = Vacant, assigning sets lead_id, the member then holds area_lead:<id>. App: - lib/permissions-catalog.ts (codes + per-role defaults + guardrails), Zod schemas, lib/actions/permissions.ts (setRolePermissions, setOpsAcl, createAreaLeadRole, assign/unassign/delete). - Customize gains Permissions (role x permission matrix, admin shown implicit-all/locked) and Area leads (create/Vacant/assign) panels, modular under customize/panels/. Reusable components/ops/ops-acl-editor.tsx wired into the Secrets list. Audit-found latent fixes: - revealSecret errors on encrypted-but-no-ciphertext corruption instead of silently returning the stale plaintext column. - upsertAreaLead rejects null/empty area_code (NULLs are distinct in unique constraints; allowed duplicate rows). types/database.ts: added the two new tables. 271/271 tests pass, build clean. KB-modal ACL wiring + members-row shortcut deferred and tracked in HANDOFF.
47 lines
1.2 KiB
TypeScript
47 lines
1.2 KiB
TypeScript
/**
|
|
* Barrel re-export for server actions.
|
|
*
|
|
* Client components and pages import action functions via `@/lib/actions`.
|
|
* Each domain lives in its own file in this directory; this barrel keeps
|
|
* the import path stable as the directory grows.
|
|
*
|
|
* Do NOT add `'use server'` here. The directive lives on the domain files
|
|
* themselves; re-exports preserve the marking.
|
|
*/
|
|
|
|
export * from './tasks'
|
|
export * from './projects'
|
|
export * from './members'
|
|
export * from './contacts'
|
|
export * from './payments'
|
|
export * from './knowledge-base'
|
|
export * from './secrets'
|
|
export * from './area-leads'
|
|
export * from './settings'
|
|
export * from './imports'
|
|
|
|
// Governance kernel (Tier 1)
|
|
export * from './proposals'
|
|
export * from './incidents'
|
|
export * from './policies'
|
|
|
|
// Per-space configurable taxonomies
|
|
export * from './areas'
|
|
|
|
// Forum and polymorphic comments
|
|
export * from './forum'
|
|
|
|
// User-creatable chat channels
|
|
export * from './comms'
|
|
|
|
// Custom tiers, custom roles, multi-code invites
|
|
export * from './tiers'
|
|
export * from './roles'
|
|
export * from './invites'
|
|
|
|
// Configurable member onboarding
|
|
export * from './onboarding'
|
|
|
|
// Customizable permissions, per-item Ops ACLs, area-lead roles
|
|
export * from './permissions'
|