mirror of
https://github.com/snapotter-hq/SnapOtter.git
synced 2026-08-03 07:46:42 +02:00
AshimandGitHub
5a45bcbc8f
* feat(rbac): add editor role, 3 new permissions, ownership helper * feat(rbac): add audit_log table, apiKeys.permissions column, editor role to schema * feat(rbac): wire requirePermission into all routes, add editor role support * refactor(rbac): replace ad-hoc role checks with permission-based ownership * feat(rbac): add audit log DB writes + query endpoint Dual-write audit events to stdout (existing) and SQLite audit_log table. Add GET /api/v1/audit-log with pagination, action filter, and date range filtering, gated behind audit:read permission. * feat(rbac): add API key permission scoping with ceiling enforcement * feat(rbac): add escalation prevention and last-admin protection * feat(rbac): add editor role to UI, API key permission scoping in settings * test(rbac): add full permission matrix integration test * test(rbac): add editor role E2E tests * feat(rbac): add custom roles with CRUD API and DB-backed permission lookup * feat(rbac): add API key expiration * feat(rbac): add roles management UI and API key expiration to settings * feat(rbac): add audit log UI to settings * fix: remove any cast in API key permission validation * test(rbac): add unit tests for username validation rules * test(rbac): add unit tests for effective permissions and ownership * test(rbac): add comprehensive route permission matrix (all routes × all roles) * test(rbac): add auth route edge case tests (login failures, session expiry, password side effects) * test(rbac): add escalation prevention tests (register, update, self-demote, last-admin) * test(rbac): add ownership enforcement tests (files, pipelines, editor access, cross-user isolation) * test(rbac): add API key edge cases (name validation, delete behavior, key revocation) * test(rbac): add audit log edge cases (all events, pagination clamping, structure) * test(rbac): add custom roles edge case tests (validation, CRUD, functional permissions) * test(rbac): add comprehensive E2E tests (roles UI, audit log, custom role, API key scoping)
20 lines
737 B
SQL
20 lines
737 B
SQL
-- Add permissions column to api_keys for scoped API keys
|
|
ALTER TABLE `api_keys` ADD COLUMN `permissions` text;
|
|
--> statement-breakpoint
|
|
-- Create audit_log table for queryable audit trail
|
|
CREATE TABLE IF NOT EXISTS `audit_log` (
|
|
`id` text PRIMARY KEY NOT NULL,
|
|
`actor_id` text REFERENCES `users`(`id`) ON DELETE SET NULL,
|
|
`actor_username` text NOT NULL,
|
|
`action` text NOT NULL,
|
|
`target_type` text,
|
|
`target_id` text,
|
|
`details` text,
|
|
`ip_address` text,
|
|
`created_at` integer NOT NULL DEFAULT (unixepoch())
|
|
);
|
|
--> statement-breakpoint
|
|
CREATE INDEX IF NOT EXISTS `audit_log_action_idx` ON `audit_log` (`action`);
|
|
--> statement-breakpoint
|
|
CREATE INDEX IF NOT EXISTS `audit_log_created_at_idx` ON `audit_log` (`created_at`);
|