7 Commits

Include renames

Author	SHA1	Message	Date
mrhid6	aa31cd8a10	fix: validate roles, guard last owner, scope bootstrap status ... Security review of e70b2f0. The UI gating was correctly backed by RequireRole everywhere; these are the missing validation gaps behind it. - UpdateUserRole and createOrgUser accepted any role string verbatim, so an admin could self-promote to owner, create an owner outright, or set a junk role that silently stripped a user's access. Roles are now whitelisted, only an owner may grant or remove the owner role, and an actor cannot change their own. - Neither demote nor delete guarded the last owner, so an org could reach zero owners. Both now refuse when no owner would remain, returning 409. Self-delete rejected. - CountUsers counted across all orgs, so a locked-out org could never re-bootstrap once another tenant existed, and the unauthenticated bootstrap-status endpoint reported instance-wide state. It now answers per-org on an org host, falling back to global only on the apex. - HandleMe repeats the middleware's host/org check; it sits outside the middleware so it can still return its own 401. - Post-bootstrap now sends the new owner to their org host's login page. The session cookie is deliberately scoped to the exact host, so the old redirect landed them unauthenticated. - AuthProvider renders an error state instead of mounting the shell with a null user when /auth/me fails for a reason other than 401. - api.ts unwraps {"error": ...} so these messages render as text.	2026-07-22 10:26:21 +01:00
mrhid6	850aa0ed05	feat(server): org-scope service layer + handlers + org admin API ... Threads org_id through every admin-facing service function (servers, keys, assignments, secrets, workflows/steps/runs, monitors, channels, audit), adds RequireRole middleware, and wires /api/org user + OIDC management routes. Agent/scheduler paths keep unique-key signatures and resolve org from the loaded record; internal-only helpers (getServerByID, getRunByID, getMonitorByID) preserve those call sites.	2026-07-21 16:56:39 +01:00
mrhid6	d0ed9885e7	feat(auth): per-org OIDC resolver replaces global provider	2026-07-21 16:41:50 +01:00
mrhid6	ff22340561	feat(auth): host-based org resolution + session/host match guard	2026-07-21 16:38:24 +01:00
mrhid6	2038e86b53	feat(auth): local email/password login + first-run bootstrap	2026-07-21 16:36:13 +01:00
mrhid6	066095ffca	feat(auth): session carries org_id/role; add context helpers	2026-07-21 16:28:06 +01:00
domrichardson	aaf154168e	updates	2026-06-15 16:20:26 +01:00