Codex review: app-modify-all implies only app-create - app-use-all is implied by
app-full-all alone. Putting use beneath modify in the ordered ladder therefore
fabricated a grant: a legacy group holding just app-modify-all displayed as
Modify, and touching the row or applying a preset silently granted use of every
app.
Ladders may now only contain keys that genuinely imply each other. Everything
else is a capability with its own checkbox, so the app row is
No access | Modify | Full plus "Use all apps" and "Create apps". A test asserts
every ladder is a real chain, so this class of mismatch fails CI rather than
shipping.
Also documents in the API docs why app list endpoints can now return FORBIDDEN
and why integration lists may return fewer records, as AGENTS.md requires.
home.getStats re-implemented the same rule the pages and navigation use, which is
exactly the drift that let a stat card link to a page that returned not-found.
getAppManagementAccess and getIntegrationManagementAccess now hold the rule, and
the nextjs helper is only a session/lookup adapter around them.
The matrix could not represent board-create, app-create, integration-create,
search-engine-create or media-upload, and savePermissions force-bundled every
create key with its modify/full parent. Together that meant a group with
board-create was silently upgraded to board-full-all on the next save, and the
common "members may create their own boards" setup became unreachable.
- permissionMatrix models create/upload as an orthogonal capability next to the
ordered access levels, so all 20 permission keys round-trip losslessly
- savePermissions stores exactly what was selected
- the matrix UI gets a per-category create checkbox, auto-checked and disabled
when the chosen level already implies it
- a management section is reachable when the user can do at least one thing in
it; nav, pages and stat cards now share one access helper
- Gate app list procedures (getPaginated/all/search) behind app-modify-all
- Filter integration list procedures by per-integration access
- Bundle create permissions with their modify/full parents on group save
- Align manage nav, home stat cards and page gates with the new scope
- Add permission matrix UI with presets and effective-permission preview
- Show scoped empty states and delegated-admin notices on the integrations page
Thomas Camlong
ajnart
homarr-update-contributors[bot]
TimonandThomas
Matt Van Horn
Nerdy Technician
Josh PrestonandThomas
Anil K TiwariandThomas
Felix-AyushandThomas