Jakub Zych cdea47a178 feat: frontend permissions and the merged-permission resolver ...

- PermissionSet reads the stored JSON tolerantly and writes an object
  of integers; FrontendPermission is the catalogue row
- MergedPermissions, HasPermission and UserHasPermission port PHP
  getMergedPermissions and Winter's hasPermission: groups merge with
  most positive wins, the user's own values override, held means
  exactly 1, wildcards as in Winter
- User gains Permissions (never serialized) and declares the avatar
  attachment relation the user API already writes

2026-10-05 13:21:51 +02:00

4.3 KiB

Raw Permalink Blame History

View Raw