Repository navigation
feat(rbac): granular roles — admin, editor, viewer - #11
Merged
Merged
Conversation
Move admin authorization from a binary admin/non-admin gate to hierarchical roles (admin > editor > viewer > user). - editor: view, create and edit agents, MCP servers and skills — cannot delete them, cannot manage permissions, and cannot access observability, audit, settings, users, LLM/providers or groups. - viewer: no admin-panel access today (reserved). - admin: unchanged (full access). Backend: - models: role constants + HasRole/NormalizeRole/IsValidRole hierarchy - config: editor_groups / viewer_groups - UserService.ResolveRole: highest of config (admin/editor/viewer groups) and DB role - middleware.RequireRole: hierarchical role gate - routes: /admin split into an editor zone (agents/mcp/skills read+create+edit) and an admin-only zone (delete + permissions of those, plus every other section) - /api/me now returns the resolved role; UpdateRole accepts editor/viewer - tests for HasRole/NormalizeRole/IsValidRole and ResolveRole Web: - UserContext exposes role; header + admin layout allow editors in - AdminNav shows only Agents/MCP/Skills to editors - delete buttons hidden for non-admins on agents/mcp/skills
Replace the binary admin toggle with a dropdown to assign any of the four roles per user. Protected users (role set by config) still show 'Protected'.
…anup - admin layout redirects editors away from admin-only sections reached by direct URL (editors only reach /admin/agents, /admin/mcp, /admin/skills) - add RoleGate middleware tests (401 no claims, 403 insufficient, pass on met) - remove dead middleware/admin.go (superseded by RequireRole) - document editor_groups/viewer_groups in configs/config.yaml - type UserContext role as UserRole instead of bare string
The useUser hook re-exported a subset of the context and omitted role, so components reading useUser().role (admin layout, header) failed the production typecheck. npm run build now passes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Replaces the binary admin/non-admin gate on
/adminwith hierarchical roles:admin > editor > viewer > user.Backend
models: role constants +HasRole/NormalizeRole/IsValidRole(hierarchy: admin 3 > editor 2 > viewer 1 > user 0).config:editor_groups/viewer_groups(Google Workspace groups, likeadmin_groups).UserService.ResolveRole(email, groups): effective role = highest of config-granted (admin users/groups, editor/viewer groups) and the DB role.middleware.RequireRole(min): hierarchical gate (replaces the binary admin middleware on/admin).routes:/adminsplit into two zones —GET/POST/PUTof agents, MCP servers, skills.DELETE+permissionsof those, plus settings, groups, audit, observability/metrics, LLM, providers, users, integrations./api/menow returns the resolvedrole;PUT /admin/users/{email}/roleacceptseditor/viewer.Web
UserContextexposesrole; header link and admin layout allow editors in.AdminNavshows only Agents / MCP Servers / Skills to editors.Assigning roles
Via config (
editor_groups/viewer_groups) or per-user in Admin → Users.Test plan
HasRole/NormalizeRole/IsValidRoleandResolveRole(config-admin/editor/viewer, DB role, highest-wins, case-insensitive) — green.go build, fullgo test ./..., webnpm run lint— green./api/mereturnsrole; admin panel still reachable (auth disabled → anonymous resolves to admin).403on audit/settings/users; nav hides those sections.Notes
403./admin/agentspage also hosts the Groups tab; Groups endpoints are admin-only, so an editor reaching/admin/groupsby URL gets403(and it's absent from their nav).🤖 Generated with Claude Code