new features
This commit is contained in:
Matthias Hochmeister
170
backend/src/database/migrations/045_add_permissions_batch.sql
Normal file
170
backend/src/database/migrations/045_add_permissions_batch.sql
Normal file
@@ -0,0 +1,170 @@
|
||||
-- Migration 045: Add new permissions + seed dependency config
|
||||
-- 1. fahrzeuge:edit
|
||||
-- 2. atemschutz:edit
|
||||
-- 3. Per-tool admin permissions
|
||||
-- 4. bestellungen:manage_orders
|
||||
|
||||
-- ═══════════════════════════════════════════════════════════════════════════
|
||||
-- 1. New permissions
|
||||
-- ═══════════════════════════════════════════════════════════════════════════
|
||||
|
||||
-- fahrzeuge:edit (between create and change_status)
|
||||
INSERT INTO permissions (id, feature_group_id, label, description, sort_order) VALUES
|
||||
('fahrzeuge:edit', 'fahrzeuge', 'Bearbeiten', 'Fahrzeugdaten bearbeiten', 2)
|
||||
ON CONFLICT (id) DO NOTHING;
|
||||
|
||||
-- atemschutz:edit (between view and create)
|
||||
INSERT INTO permissions (id, feature_group_id, label, description, sort_order) VALUES
|
||||
('atemschutz:edit', 'atemschutz', 'Bearbeiten', 'Atemschutz-Einträge bearbeiten', 2)
|
||||
ON CONFLICT (id) DO NOTHING;
|
||||
|
||||
-- bestellungen:manage_orders (manage order status + received quantities)
|
||||
INSERT INTO permissions (id, feature_group_id, label, description, sort_order) VALUES
|
||||
('bestellungen:manage_orders', 'bestellungen', 'Bestellungen verwalten', 'Bestellstatus ändern und Wareneingänge verbuchen', 3)
|
||||
ON CONFLICT (id) DO NOTHING;
|
||||
|
||||
-- Per-tool admin permissions
|
||||
INSERT INTO permissions (id, feature_group_id, label, description, sort_order) VALUES
|
||||
('admin:view_services', 'admin', 'Services ansehen', 'Service-Monitoring einsehen', 3),
|
||||
('admin:edit_services', 'admin', 'Services bearbeiten', 'Überwachte Services verwalten', 4),
|
||||
('admin:view_system', 'admin', 'System ansehen', 'Systeminformationen einsehen', 5),
|
||||
('admin:view_users', 'admin', 'Benutzer ansehen', 'Benutzerliste einsehen', 6),
|
||||
('admin:edit_users', 'admin', 'Benutzer bearbeiten', 'Benutzereinstellungen verwalten', 7),
|
||||
('admin:edit_broadcast', 'admin', 'Broadcast senden', 'Push-Benachrichtigungen senden', 8),
|
||||
('admin:view_banner', 'admin', 'Banner ansehen', 'Ankündigungs-Banner einsehen', 9),
|
||||
('admin:edit_banner', 'admin', 'Banner bearbeiten', 'Ankündigungs-Banner verwalten', 10),
|
||||
('admin:view_maintenance', 'admin', 'Wartung ansehen', 'Wartungsmodus-Status einsehen', 11),
|
||||
('admin:edit_maintenance', 'admin', 'Wartung bearbeiten', 'Wartungsmodus umschalten', 12),
|
||||
('admin:view_fdisk', 'admin', 'FDISK ansehen', 'FDISK-Synchronisation einsehen', 13),
|
||||
('admin:edit_fdisk', 'admin', 'FDISK bearbeiten', 'FDISK-Synchronisation starten/verwalten', 14),
|
||||
('admin:view_permissions', 'admin', 'Berechtigungen ansehen', 'Berechtigungsmatrix einsehen', 15),
|
||||
('admin:edit_permissions', 'admin', 'Berechtigungen bearbeiten','Berechtigungen und Abhängigkeiten ändern',16),
|
||||
('admin:view_order_settings', 'admin', 'Bestell-Admin ansehen', 'Bestellungs-Admin-Einstellungen einsehen',17),
|
||||
('admin:edit_order_settings', 'admin', 'Bestell-Admin bearbeiten','Bestellungs-Admin-Einstellungen ändern', 18),
|
||||
('admin:view_data', 'admin', 'Datenverwaltung ansehen', 'Datenverwaltung einsehen', 19),
|
||||
('admin:edit_data', 'admin', 'Datenverwaltung bearbeiten','Daten importieren/exportieren/bereinigen',20),
|
||||
('admin:view_debug', 'admin', 'Debug ansehen', 'Debug-Informationen einsehen', 21)
|
||||
ON CONFLICT (id) DO NOTHING;
|
||||
|
||||
-- ═══════════════════════════════════════════════════════════════════════════
|
||||
-- 2. Seed grants for existing groups
|
||||
-- ═══════════════════════════════════════════════════════════════════════════
|
||||
|
||||
-- Give fahrzeuge:edit to groups that already have fahrzeuge:create
|
||||
INSERT INTO group_permissions (authentik_group, permission_id)
|
||||
SELECT authentik_group, 'fahrzeuge:edit'
|
||||
FROM group_permissions WHERE permission_id = 'fahrzeuge:create'
|
||||
ON CONFLICT DO NOTHING;
|
||||
|
||||
-- Give atemschutz:edit to groups that already have atemschutz:create
|
||||
INSERT INTO group_permissions (authentik_group, permission_id)
|
||||
SELECT authentik_group, 'atemschutz:edit'
|
||||
FROM group_permissions WHERE permission_id = 'atemschutz:create'
|
||||
ON CONFLICT DO NOTHING;
|
||||
|
||||
-- Give bestellungen:manage_orders to groups that already have bestellungen:create
|
||||
INSERT INTO group_permissions (authentik_group, permission_id)
|
||||
SELECT authentik_group, 'bestellungen:manage_orders'
|
||||
FROM group_permissions WHERE permission_id = 'bestellungen:create'
|
||||
ON CONFLICT DO NOTHING;
|
||||
|
||||
-- Give all admin sub-permissions to groups that have admin:write
|
||||
INSERT INTO group_permissions (authentik_group, permission_id)
|
||||
SELECT gp.authentik_group, p.id
|
||||
FROM group_permissions gp
|
||||
CROSS JOIN permissions p
|
||||
WHERE gp.permission_id = 'admin:write'
|
||||
AND p.feature_group_id = 'admin'
|
||||
AND p.id NOT IN ('admin:view', 'admin:write')
|
||||
ON CONFLICT DO NOTHING;
|
||||
|
||||
-- Give all admin view sub-permissions to groups that have admin:view but not admin:write
|
||||
INSERT INTO group_permissions (authentik_group, permission_id)
|
||||
SELECT gp.authentik_group, p.id
|
||||
FROM group_permissions gp
|
||||
CROSS JOIN permissions p
|
||||
WHERE gp.permission_id = 'admin:view'
|
||||
AND p.feature_group_id = 'admin'
|
||||
AND p.id LIKE 'admin:view_%'
|
||||
ON CONFLICT DO NOTHING;
|
||||
|
||||
-- ═══════════════════════════════════════════════════════════════════════════
|
||||
-- 3. Seed default permission dependency config
|
||||
-- ═══════════════════════════════════════════════════════════════════════════
|
||||
-- Only insert if no config exists yet (don't overwrite manual edits)
|
||||
|
||||
INSERT INTO app_settings (key, value)
|
||||
SELECT 'permission_deps', '{
|
||||
"kalender:create": ["kalender:view"],
|
||||
"kalender:view_bookings": ["kalender:view"],
|
||||
"kalender:manage_bookings": ["kalender:view_bookings", "kalender:view"],
|
||||
|
||||
"fahrzeuge:edit": ["fahrzeuge:view"],
|
||||
"fahrzeuge:create": ["fahrzeuge:view"],
|
||||
"fahrzeuge:change_status": ["fahrzeuge:view"],
|
||||
"fahrzeuge:manage_maintenance": ["fahrzeuge:view"],
|
||||
"fahrzeuge:delete": ["fahrzeuge:create", "fahrzeuge:view"],
|
||||
"fahrzeuge:widget": ["fahrzeuge:view"],
|
||||
|
||||
"einsaetze:view_reports": ["einsaetze:view"],
|
||||
"einsaetze:create": ["einsaetze:view"],
|
||||
"einsaetze:delete": ["einsaetze:create", "einsaetze:view"],
|
||||
"einsaetze:manage_personnel": ["einsaetze:view"],
|
||||
|
||||
"ausruestung:create": ["ausruestung:view"],
|
||||
"ausruestung:manage_maintenance": ["ausruestung:view"],
|
||||
"ausruestung:delete": ["ausruestung:create", "ausruestung:view"],
|
||||
"ausruestung:manage_categories": ["ausruestung:view"],
|
||||
"ausruestung:widget": ["ausruestung:view"],
|
||||
|
||||
"mitglieder:view_all": ["mitglieder:view_own"],
|
||||
"mitglieder:edit": ["mitglieder:view_all", "mitglieder:view_own"],
|
||||
"mitglieder:create_profile": ["mitglieder:edit", "mitglieder:view_all", "mitglieder:view_own"],
|
||||
|
||||
"atemschutz:edit": ["atemschutz:view"],
|
||||
"atemschutz:create": ["atemschutz:view"],
|
||||
"atemschutz:delete": ["atemschutz:create", "atemschutz:view"],
|
||||
"atemschutz:widget": ["atemschutz:view"],
|
||||
|
||||
"bestellungen:create": ["bestellungen:view"],
|
||||
"bestellungen:manage_orders": ["bestellungen:view"],
|
||||
"bestellungen:delete": ["bestellungen:view"],
|
||||
"bestellungen:manage_vendors": ["bestellungen:view"],
|
||||
"bestellungen:export": ["bestellungen:view"],
|
||||
"bestellungen:manage_reminders": ["bestellungen:view"],
|
||||
"bestellungen:widget": ["bestellungen:view"],
|
||||
|
||||
"shop:create_request": ["shop:view"],
|
||||
"shop:manage_catalog": ["shop:view"],
|
||||
"shop:approve_requests": ["shop:view"],
|
||||
"shop:link_orders": ["shop:approve_requests", "shop:view"],
|
||||
"shop:view_overview": ["shop:view"],
|
||||
"shop:order_for_user": ["shop:create_request", "shop:view"],
|
||||
"shop:widget": ["shop:view"],
|
||||
|
||||
"issues:view_own": ["issues:create"],
|
||||
"issues:view_all": ["issues:view_own"],
|
||||
"issues:manage": ["issues:view_all", "issues:view_own"],
|
||||
|
||||
"admin:edit_services": ["admin:view_services", "admin:view"],
|
||||
"admin:view_services": ["admin:view"],
|
||||
"admin:view_system": ["admin:view"],
|
||||
"admin:edit_users": ["admin:view_users", "admin:view"],
|
||||
"admin:view_users": ["admin:view"],
|
||||
"admin:edit_broadcast": ["admin:view"],
|
||||
"admin:edit_banner": ["admin:view_banner", "admin:view"],
|
||||
"admin:view_banner": ["admin:view"],
|
||||
"admin:edit_maintenance": ["admin:view_maintenance", "admin:view"],
|
||||
"admin:view_maintenance": ["admin:view"],
|
||||
"admin:edit_fdisk": ["admin:view_fdisk", "admin:view"],
|
||||
"admin:view_fdisk": ["admin:view"],
|
||||
"admin:edit_permissions": ["admin:view_permissions", "admin:view"],
|
||||
"admin:view_permissions": ["admin:view"],
|
||||
"admin:edit_order_settings": ["admin:view_order_settings", "admin:view"],
|
||||
"admin:view_order_settings": ["admin:view"],
|
||||
"admin:edit_data": ["admin:view_data", "admin:view"],
|
||||
"admin:view_data": ["admin:view"],
|
||||
"admin:view_debug": ["admin:view"]
|
||||
}'::jsonb
|
||||
WHERE NOT EXISTS (SELECT 1 FROM app_settings WHERE key = 'permission_deps');
|
||||
|
||||
Reference in New Issue
Block a user