From 053c643527ef9ed8e3fdcee904737efc30dc2ac3 Mon Sep 17 00:00:00 2001 From: Jakub Zych Date: Wed, 21 Oct 2026 18:18:24 +0200 Subject: [PATCH] docs(19.6.1): record post-research decisions D-19..D-22 --- .../19.6.1-backend-administrators-screen/19.6.1-CONTEXT.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.planning/phases/19.6.1-backend-administrators-screen/19.6.1-CONTEXT.md b/.planning/phases/19.6.1-backend-administrators-screen/19.6.1-CONTEXT.md index 3a3d4470..1de11a3e 100644 --- a/.planning/phases/19.6.1-backend-administrators-screen/19.6.1-CONTEXT.md +++ b/.planning/phases/19.6.1-backend-administrators-screen/19.6.1-CONTEXT.md @@ -82,6 +82,12 @@ The phase is kept short (1-2 plans). Existing cabana payloads and the `admin:*` ### Quality gates - **D-18:** Unit tests are the last plan (project rule). They cover every privilege rule in D-05 to D-09, including the concurrent last-superuser case, plus D-12 revocation and the D-14 seam (boot errors, permission filtering, run path). Docs: the cabana README and the affected `docs/` pages are updated in the same commits as the API, config and permission changes. If `admin/` changes, `check-admin-openapi.sh` and the committed `modules/boardwalk/dist` gate (`check-admin-dist.sh`) apply. +### Post-research decisions (2026-10-21, plan-phase) +- **D-19:** **No outranking.** A non-superuser with the manage-administrators permission is refused (403) when updating, deleting or running record/bulk actions on a non-superuser admin whose effective role + permissions grant more than the caller holds (closes the password-set account-takeover path). +- **D-20:** **Own password is not set on this screen.** Sending a password for your own record on the Administrators form is refused; the error points to My Account, which checks the current password. +- **D-21:** **SPA support is in scope.** D-06 (permission override disabled while `is_superuser` is on) gets a real field `trigger` in fields.yaml and the admin SPA, and D-16 (code-declared role grants) gets per-record locked permission values rendered as locked in the permission editor. Server-side enforcement stays authoritative. The `admin/` change regenerates `admin/openapi/admin.json` + `schema.d.ts` (`scripts/check-admin-openapi.sh`) and rebuilds the committed `modules/boardwalk/dist` (`scripts/check-admin-dist.sh`). +- **D-22:** **Three plans:** 01 the pact action-extension seam, the internal cabana pseudo-plugin with Administrators + Roles controllers, privilege guards, lang keys and docs (server side); 02 a short plan for the SPA support in D-21; 03 unit + Postgres tests (last, per project rule). + ### Claude's Discretion - How the internal pseudo-plugin is shaped and named (id, for example `summercms.cabana` / `backend.*` controller IDs), as long as it reuses the existing `summercms.cabana` migration id and doesn't collide with the reserved first path segments. - Exact Go identifiers for the D-14 capability and its types.