5bb39da598
Viewers could mutate posts, automations and trigger AI write endpoints,
and every role saw create/manage affordances that 403'd on click.
Backend (security):
- PostPolicy update/delete now require member+ (was tenancy-only), which
also gates the AI write endpoints that authorize('update')
- AutomationPolicy create/update/delete require member+; activate/pause
delegate to update
- AutomationController authorizes index/store/show; AnalyticsController
authorizes view
- Comments stay open to members incl. viewer (by design)
Frontend (UI gating via new useWorkspaceRole composable):
- Sidebar: create post / create workspace / automations / library nav
- Accounts grid: connect / disconnect / reconnect (admin+)
- Members: invite / change role / remove / cancel invite (admin+)
- Account billing tab (owner); posts index + calendar create affordances
Tests: PostPolicyTest, AutomationPolicyTest (all four roles) and an
end-to-end WorkspaceRolePermissionsTest; aligned the automation test
suites' account/workspace setup with role pivots.
|
||
|---|---|---|
| .. | ||
| components | ||
| composables | ||
| data | ||
| layouts | ||
| lib | ||
| pages | ||
| types | ||
| utils | ||
| app.ts | ||
| datalayer.ts | ||
| date.ts | ||
| dayjs.ts | ||
| debounce.ts | ||
| echo.ts | ||
| posthog.ts | ||
| ssr.ts | ||