mirror of
https://github.com/jhd3197/ServerKit.git
synced 2026-11-09 05:24:49 +09:00
Juan DenisandClaude Opus 4.8
d9a5ec7e92
An owner/admin can share a specific application (transitively its WordPress site / DB / domains) with a specific user who doesn't own it. Access-level for now; per-grant view/edit roles are reserved via a role column. - New ResourceGrant model (Alembic 016, unique per user x resource) + ResourceGrantService (grant/revoke/list/user_has_grant/granted_ids). - Enforcement at the cleanest seams: scope_query gained grant_resource_type so granted apps appear in the apps list (own OR granted, then workspace-narrowed); get_app and the WordPress _owner_or_admin_app helper became grant-aware, so one change opens every WP per-site route to a grantee. - Grant-management API (GET/POST/DELETE /apps/<id>/grants, owner-or-admin; can't grant to the owner; revoke is resource-scoped so you can't revoke another app's grant by id). Uses user.id (int), not the stringified get_jwt_identity(). Verified: 4 new ACL tests (visibility, get_app, WP route access, management perms + idempotency + revoke), full suite 127 passed, end-to-end alembic upgrade to 016. Deferred: a Sharing UI (next), and broadening grant-access to the generic app operate endpoints (start/stop/update stay owner-or-admin; delete stays owner-only). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>