mirror of
https://github.com/maziggy/bambuddy.git
synced 2026-09-30 11:12:35 +02:00
maziggy
7c117dc6bc
Archives, the queue and statistics report ownership as a numeric created_by_id, and statistics accept it as a filter, but nothing let an API key discover whose id was whose -- the only user listing returns emails, roles, group membership and full permission sets, so it is administrative and rejects keys. Add GET /users/slim returning id + username only, gated on a new users:read_slim permission mapped to can_read_status. That grants no data a key could not already reach: for API-keyed requests the permission deps return None as current_user, so the stats:filter_by_user guard short-circuits and ?created_by_id=N is already honoured for every N. What was missing was the ability to address the filter, not permission to use it. The full listing stays unmapped = admin-only. Also fix /auth/me, which answered an API key with a synthetic administrator: id 0, role admin, is_admin true and every permission in the enum. A key cannot reach an administrative route at all, so clients building their UI from that response rendered actions that 403 on use. It now reports the key owner's identity, is_admin false, and the permissions the key's scopes actually admit. Ownerless legacy keys keep id 0 but no longer claim admin. --- Source user names from the slim listing where only names are needed (#1894) Stats filter-by-user, the Archives print log filter, the File Manager username autocomplete, the camera-token owner column and the Finance member picker all render nothing but a username, but all of them read the full user listing, which is gated on the admin-level users:read. An operator granted stats:filter_by_user but not users:read got an empty filter with no indication why. Point them at /users/slim under a separate react-query key, since the full listing shares the 'users' key and the two shapes would clobber each other in the cache.
529 lines
20 KiB
Python
529 lines
20 KiB
Python
"""Permission definitions for the group-based access control system.
|
|
|
|
This module defines all permissions using a string enum with `resource:action` naming.
|
|
Permissions are additive across groups - a user has all permissions from all their groups.
|
|
"""
|
|
|
|
from backend.app.core.compat import StrEnum
|
|
|
|
|
|
class Permission(StrEnum):
|
|
"""All available permissions in the system.
|
|
|
|
Permissions follow the pattern: resource:action
|
|
Actions typically include: read, create, update, delete, plus resource-specific actions.
|
|
"""
|
|
|
|
# Printers
|
|
PRINTERS_READ = "printers:read"
|
|
PRINTERS_CREATE = "printers:create"
|
|
PRINTERS_UPDATE = "printers:update"
|
|
PRINTERS_DELETE = "printers:delete"
|
|
PRINTERS_CONTROL = "printers:control" # Printer controls: stop/pause/resume, lights, motors, drying, etc.
|
|
PRINTERS_FILES = "printers:files" # Send files to printer
|
|
PRINTERS_AMS_RFID = "printers:ams_rfid" # Re-read AMS RFID tags
|
|
PRINTERS_CLEAR_PLATE = "printers:clear_plate" # Confirm plate cleared for next print
|
|
|
|
# Archives
|
|
# ARCHIVES_READ kept for backward-compat with legacy custom roles, but new
|
|
# role bootstraps use the ownership-split variants below. seed_default_groups
|
|
# migrates pre-existing role rows: Administrators → ALL, everyone else → OWN.
|
|
ARCHIVES_READ = "archives:read"
|
|
ARCHIVES_READ_OWN = "archives:read_own"
|
|
ARCHIVES_READ_ALL = "archives:read_all"
|
|
ARCHIVES_CREATE = "archives:create"
|
|
ARCHIVES_UPDATE_OWN = "archives:update_own"
|
|
ARCHIVES_UPDATE_ALL = "archives:update_all"
|
|
ARCHIVES_DELETE_OWN = "archives:delete_own"
|
|
ARCHIVES_DELETE_ALL = "archives:delete_all"
|
|
ARCHIVES_REPRINT_OWN = "archives:reprint_own" # Reprint own archives; queue:create is also required to enqueue
|
|
ARCHIVES_REPRINT_ALL = "archives:reprint_all" # Reprint any archive; queue:create is also required to enqueue
|
|
ARCHIVES_PURGE = "archives:purge"
|
|
|
|
# Queue
|
|
QUEUE_READ = "queue:read"
|
|
QUEUE_READ_OWN = "queue:read_own"
|
|
QUEUE_READ_ALL = "queue:read_all"
|
|
QUEUE_CREATE = "queue:create" # Create queue items, including ASAP items eligible for immediate dispatch
|
|
QUEUE_UPDATE_OWN = "queue:update_own"
|
|
QUEUE_UPDATE_ALL = "queue:update_all"
|
|
QUEUE_DELETE_OWN = "queue:delete_own"
|
|
QUEUE_DELETE_ALL = "queue:delete_all"
|
|
QUEUE_REORDER = "queue:reorder"
|
|
|
|
# Library
|
|
LIBRARY_READ = "library:read"
|
|
LIBRARY_READ_OWN = "library:read_own"
|
|
LIBRARY_READ_ALL = "library:read_all"
|
|
LIBRARY_UPLOAD = "library:upload" # Upload/import/slice library files; queue:create is also required to print
|
|
LIBRARY_UPDATE_OWN = "library:update_own"
|
|
LIBRARY_UPDATE_ALL = "library:update_all"
|
|
LIBRARY_DELETE_OWN = "library:delete_own"
|
|
LIBRARY_DELETE_ALL = "library:delete_all"
|
|
# Admin-only: bulk purge of old files + trash retention settings (#1008).
|
|
# Routine per-user trash management (restore-own, hard-delete-own) is
|
|
# gated by the existing LIBRARY_DELETE_* permissions instead.
|
|
LIBRARY_PURGE = "library:purge"
|
|
|
|
# Projects
|
|
PROJECTS_READ = "projects:read"
|
|
PROJECTS_CREATE = "projects:create"
|
|
PROJECTS_UPDATE = "projects:update"
|
|
PROJECTS_DELETE = "projects:delete"
|
|
|
|
# Filaments
|
|
FILAMENTS_READ = "filaments:read"
|
|
FILAMENTS_CREATE = "filaments:create"
|
|
FILAMENTS_UPDATE = "filaments:update"
|
|
FILAMENTS_DELETE = "filaments:delete"
|
|
|
|
# Inventory (Spool Inventory, Spool Catalog, Color Catalog)
|
|
INVENTORY_READ = "inventory:read"
|
|
INVENTORY_CREATE = "inventory:create"
|
|
INVENTORY_UPDATE = "inventory:update"
|
|
INVENTORY_DELETE = "inventory:delete"
|
|
INVENTORY_VIEW_ASSIGNMENTS = "inventory:view_assignments" # View spool-to-AMS assignments on printer cards
|
|
INVENTORY_FORECAST_READ = "inventory:forecast_read" # View forecast/reorder intelligence panel
|
|
INVENTORY_FORECAST_WRITE = "inventory:forecast_write" # Modify SKU settings, lead times, shopping list
|
|
|
|
# Smart Plugs
|
|
SMART_PLUGS_READ = "smart_plugs:read"
|
|
SMART_PLUGS_CREATE = "smart_plugs:create"
|
|
SMART_PLUGS_UPDATE = "smart_plugs:update"
|
|
SMART_PLUGS_DELETE = "smart_plugs:delete"
|
|
SMART_PLUGS_CONTROL = "smart_plugs:control" # Turn on/off
|
|
|
|
# Camera
|
|
CAMERA_VIEW = "camera:view"
|
|
|
|
# Maintenance
|
|
MAINTENANCE_READ = "maintenance:read"
|
|
MAINTENANCE_CREATE = "maintenance:create"
|
|
MAINTENANCE_UPDATE = "maintenance:update"
|
|
MAINTENANCE_DELETE = "maintenance:delete"
|
|
|
|
# K-Profiles
|
|
KPROFILES_READ = "kprofiles:read"
|
|
KPROFILES_CREATE = "kprofiles:create"
|
|
KPROFILES_UPDATE = "kprofiles:update"
|
|
KPROFILES_DELETE = "kprofiles:delete"
|
|
|
|
# Notifications
|
|
NOTIFICATIONS_READ = "notifications:read"
|
|
NOTIFICATIONS_CREATE = "notifications:create"
|
|
NOTIFICATIONS_UPDATE = "notifications:update"
|
|
NOTIFICATIONS_DELETE = "notifications:delete"
|
|
NOTIFICATIONS_USER_EMAIL = "notifications:user_email" # Receive per-user print email notifications
|
|
# Notification Templates
|
|
NOTIFICATION_TEMPLATES_READ = "notification_templates:read"
|
|
NOTIFICATION_TEMPLATES_UPDATE = "notification_templates:update"
|
|
|
|
# External Links
|
|
EXTERNAL_LINKS_READ = "external_links:read"
|
|
EXTERNAL_LINKS_CREATE = "external_links:create"
|
|
EXTERNAL_LINKS_UPDATE = "external_links:update"
|
|
EXTERNAL_LINKS_DELETE = "external_links:delete"
|
|
|
|
# Discovery (network scanning)
|
|
DISCOVERY_SCAN = "discovery:scan"
|
|
|
|
# Firmware
|
|
FIRMWARE_READ = "firmware:read"
|
|
FIRMWARE_UPDATE = "firmware:update"
|
|
|
|
# AMS History
|
|
AMS_HISTORY_READ = "ams_history:read"
|
|
PRINTER_SENSOR_HISTORY_READ = "printer_sensor_history:read"
|
|
|
|
# Stats/Metrics
|
|
STATS_READ = "stats:read"
|
|
STATS_FILTER_BY_USER = "stats:filter_by_user"
|
|
|
|
# Cost Centers
|
|
COST_CENTERS_READ_OWN = "cost_centers:read_own"
|
|
COST_CENTERS_READ_ALL = "cost_centers:read_all"
|
|
COST_CENTERS_MODIFY = "cost_centers:modify"
|
|
COST_CENTERS_CREATE = "cost_centers:create"
|
|
|
|
# System Info
|
|
SYSTEM_READ = "system:read"
|
|
|
|
# Settings (admin-level)
|
|
SETTINGS_READ = "settings:read"
|
|
SETTINGS_UPDATE = "settings:update"
|
|
SETTINGS_BACKUP = "settings:backup"
|
|
SETTINGS_RESTORE = "settings:restore"
|
|
|
|
# GitHub Backup (admin-level)
|
|
GITHUB_BACKUP = "github:backup"
|
|
GITHUB_RESTORE = "github:restore"
|
|
|
|
# Cloud Auth (admin-level)
|
|
CLOUD_AUTH = "cloud:auth"
|
|
ORCA_CLOUD_AUTH = "orca_cloud:auth"
|
|
|
|
# MakerWorld Integration
|
|
MAKERWORLD_VIEW = "makerworld:view" # Resolve MakerWorld URLs and view model metadata
|
|
MAKERWORLD_IMPORT = "makerworld:import" # Download 3MFs from MakerWorld into the library
|
|
|
|
# API Keys (admin-level)
|
|
API_KEYS_READ = "api_keys:read"
|
|
API_KEYS_CREATE = "api_keys:create"
|
|
API_KEYS_UPDATE = "api_keys:update"
|
|
API_KEYS_DELETE = "api_keys:delete"
|
|
|
|
# Users (admin-level)
|
|
USERS_READ = "users:read"
|
|
# Narrow read: id + username only, no emails/roles/groups/permissions (#1894).
|
|
# Exists so an id -> name mapping can be resolved without handing out the
|
|
# full user objects. Pairs with STATS_FILTER_BY_USER, which is useless
|
|
# without a way to discover the ids it filters on.
|
|
USERS_READ_SLIM = "users:read_slim"
|
|
USERS_CREATE = "users:create"
|
|
USERS_UPDATE = "users:update"
|
|
USERS_DELETE = "users:delete"
|
|
|
|
# Groups (admin-level)
|
|
GROUPS_READ = "groups:read"
|
|
GROUPS_CREATE = "groups:create"
|
|
GROUPS_UPDATE = "groups:update"
|
|
GROUPS_DELETE = "groups:delete"
|
|
|
|
# Slicer Pipelines (#1425)
|
|
PIPELINES_READ = "pipelines:read" # View pipeline definitions and run history
|
|
PIPELINES_WRITE = "pipelines:write" # Create / edit / delete pipeline definitions
|
|
PIPELINES_RUN = "pipelines:run" # Kick off a pipeline run (PR C); separate because spending filament is a different trust dimension than authoring the recipe
|
|
|
|
# WebSocket connection
|
|
WEBSOCKET_CONNECT = "websocket:connect"
|
|
|
|
|
|
# Permission categories for UI organization
|
|
PERMISSION_CATEGORIES = {
|
|
"Printers": [
|
|
Permission.PRINTERS_READ,
|
|
Permission.PRINTERS_CREATE,
|
|
Permission.PRINTERS_UPDATE,
|
|
Permission.PRINTERS_DELETE,
|
|
Permission.PRINTERS_CONTROL,
|
|
Permission.PRINTERS_FILES,
|
|
Permission.PRINTERS_AMS_RFID,
|
|
Permission.PRINTERS_CLEAR_PLATE,
|
|
],
|
|
"Archives": [
|
|
Permission.ARCHIVES_READ, # legacy — kept for back-compat with custom roles
|
|
Permission.ARCHIVES_READ_OWN,
|
|
Permission.ARCHIVES_READ_ALL,
|
|
Permission.ARCHIVES_CREATE,
|
|
Permission.ARCHIVES_UPDATE_OWN,
|
|
Permission.ARCHIVES_UPDATE_ALL,
|
|
Permission.ARCHIVES_DELETE_OWN,
|
|
Permission.ARCHIVES_DELETE_ALL,
|
|
Permission.ARCHIVES_REPRINT_OWN,
|
|
Permission.ARCHIVES_REPRINT_ALL,
|
|
Permission.ARCHIVES_PURGE,
|
|
],
|
|
"Queue": [
|
|
Permission.QUEUE_READ, # legacy — kept for back-compat with custom roles
|
|
Permission.QUEUE_READ_OWN,
|
|
Permission.QUEUE_READ_ALL,
|
|
Permission.QUEUE_CREATE,
|
|
Permission.QUEUE_UPDATE_OWN,
|
|
Permission.QUEUE_UPDATE_ALL,
|
|
Permission.QUEUE_DELETE_OWN,
|
|
Permission.QUEUE_DELETE_ALL,
|
|
Permission.QUEUE_REORDER,
|
|
],
|
|
"Library": [
|
|
Permission.LIBRARY_READ, # legacy — kept for back-compat with custom roles
|
|
Permission.LIBRARY_READ_OWN,
|
|
Permission.LIBRARY_READ_ALL,
|
|
Permission.LIBRARY_UPLOAD,
|
|
Permission.LIBRARY_UPDATE_OWN,
|
|
Permission.LIBRARY_UPDATE_ALL,
|
|
Permission.LIBRARY_DELETE_OWN,
|
|
Permission.LIBRARY_DELETE_ALL,
|
|
Permission.LIBRARY_PURGE,
|
|
],
|
|
"Projects": [
|
|
Permission.PROJECTS_READ,
|
|
Permission.PROJECTS_CREATE,
|
|
Permission.PROJECTS_UPDATE,
|
|
Permission.PROJECTS_DELETE,
|
|
],
|
|
"Filaments": [
|
|
Permission.FILAMENTS_READ,
|
|
Permission.FILAMENTS_CREATE,
|
|
Permission.FILAMENTS_UPDATE,
|
|
Permission.FILAMENTS_DELETE,
|
|
],
|
|
"Inventory": [
|
|
Permission.INVENTORY_READ,
|
|
Permission.INVENTORY_CREATE,
|
|
Permission.INVENTORY_UPDATE,
|
|
Permission.INVENTORY_DELETE,
|
|
Permission.INVENTORY_VIEW_ASSIGNMENTS,
|
|
Permission.INVENTORY_FORECAST_READ,
|
|
Permission.INVENTORY_FORECAST_WRITE,
|
|
],
|
|
"Smart Plugs": [
|
|
Permission.SMART_PLUGS_READ,
|
|
Permission.SMART_PLUGS_CREATE,
|
|
Permission.SMART_PLUGS_UPDATE,
|
|
Permission.SMART_PLUGS_DELETE,
|
|
Permission.SMART_PLUGS_CONTROL,
|
|
],
|
|
"Camera": [
|
|
Permission.CAMERA_VIEW,
|
|
],
|
|
"Maintenance": [
|
|
Permission.MAINTENANCE_READ,
|
|
Permission.MAINTENANCE_CREATE,
|
|
Permission.MAINTENANCE_UPDATE,
|
|
Permission.MAINTENANCE_DELETE,
|
|
],
|
|
"K-Profiles": [
|
|
Permission.KPROFILES_READ,
|
|
Permission.KPROFILES_CREATE,
|
|
Permission.KPROFILES_UPDATE,
|
|
Permission.KPROFILES_DELETE,
|
|
],
|
|
"Notifications": [
|
|
Permission.NOTIFICATIONS_READ,
|
|
Permission.NOTIFICATIONS_CREATE,
|
|
Permission.NOTIFICATIONS_UPDATE,
|
|
Permission.NOTIFICATIONS_DELETE,
|
|
Permission.NOTIFICATIONS_USER_EMAIL,
|
|
Permission.NOTIFICATION_TEMPLATES_READ,
|
|
Permission.NOTIFICATION_TEMPLATES_UPDATE,
|
|
],
|
|
"External Links": [
|
|
Permission.EXTERNAL_LINKS_READ,
|
|
Permission.EXTERNAL_LINKS_CREATE,
|
|
Permission.EXTERNAL_LINKS_UPDATE,
|
|
Permission.EXTERNAL_LINKS_DELETE,
|
|
],
|
|
"Discovery": [
|
|
Permission.DISCOVERY_SCAN,
|
|
],
|
|
"Firmware": [
|
|
Permission.FIRMWARE_READ,
|
|
Permission.FIRMWARE_UPDATE,
|
|
],
|
|
"Stats & History": [
|
|
Permission.AMS_HISTORY_READ,
|
|
Permission.PRINTER_SENSOR_HISTORY_READ,
|
|
Permission.STATS_READ,
|
|
Permission.STATS_FILTER_BY_USER,
|
|
],
|
|
"Finance": [
|
|
Permission.COST_CENTERS_READ_OWN,
|
|
Permission.COST_CENTERS_READ_ALL,
|
|
Permission.COST_CENTERS_MODIFY,
|
|
Permission.COST_CENTERS_CREATE,
|
|
],
|
|
"System": [
|
|
Permission.SYSTEM_READ,
|
|
],
|
|
"Settings": [
|
|
Permission.SETTINGS_READ,
|
|
Permission.SETTINGS_UPDATE,
|
|
Permission.SETTINGS_BACKUP,
|
|
Permission.SETTINGS_RESTORE,
|
|
],
|
|
"Backup": [
|
|
Permission.GITHUB_BACKUP,
|
|
Permission.GITHUB_RESTORE,
|
|
],
|
|
"Cloud": [
|
|
Permission.CLOUD_AUTH,
|
|
Permission.ORCA_CLOUD_AUTH,
|
|
],
|
|
"MakerWorld": [
|
|
Permission.MAKERWORLD_VIEW,
|
|
Permission.MAKERWORLD_IMPORT,
|
|
],
|
|
"API Keys": [
|
|
Permission.API_KEYS_READ,
|
|
Permission.API_KEYS_CREATE,
|
|
Permission.API_KEYS_UPDATE,
|
|
Permission.API_KEYS_DELETE,
|
|
],
|
|
"User Management": [
|
|
Permission.USERS_READ,
|
|
Permission.USERS_READ_SLIM,
|
|
Permission.USERS_CREATE,
|
|
Permission.USERS_UPDATE,
|
|
Permission.USERS_DELETE,
|
|
Permission.GROUPS_READ,
|
|
Permission.GROUPS_CREATE,
|
|
Permission.GROUPS_UPDATE,
|
|
Permission.GROUPS_DELETE,
|
|
],
|
|
"Slicer Pipelines": [
|
|
Permission.PIPELINES_READ,
|
|
Permission.PIPELINES_WRITE,
|
|
Permission.PIPELINES_RUN,
|
|
],
|
|
"WebSocket": [
|
|
Permission.WEBSOCKET_CONNECT,
|
|
],
|
|
}
|
|
|
|
|
|
# All permissions as a list
|
|
ALL_PERMISSIONS = [p.value for p in Permission]
|
|
|
|
|
|
# Default group definitions
|
|
DEFAULT_GROUPS = {
|
|
"Administrators": {
|
|
"description": "Full access to all features and settings",
|
|
"permissions": ALL_PERMISSIONS, # All permissions
|
|
"is_system": True,
|
|
},
|
|
"Operators": {
|
|
"description": "Can control printers, manage queue and archives, view settings",
|
|
"permissions": [
|
|
# Printers - full control
|
|
Permission.PRINTERS_READ.value,
|
|
Permission.PRINTERS_CREATE.value,
|
|
Permission.PRINTERS_UPDATE.value,
|
|
Permission.PRINTERS_DELETE.value,
|
|
Permission.PRINTERS_CONTROL.value,
|
|
Permission.PRINTERS_FILES.value,
|
|
Permission.PRINTERS_AMS_RFID.value,
|
|
Permission.PRINTERS_CLEAR_PLATE.value,
|
|
# Archives - own items only
|
|
Permission.ARCHIVES_READ_OWN.value,
|
|
Permission.ARCHIVES_CREATE.value,
|
|
Permission.ARCHIVES_UPDATE_OWN.value,
|
|
Permission.ARCHIVES_DELETE_OWN.value,
|
|
Permission.ARCHIVES_REPRINT_OWN.value,
|
|
# Queue - own items only
|
|
Permission.QUEUE_READ_OWN.value,
|
|
Permission.QUEUE_CREATE.value,
|
|
Permission.QUEUE_UPDATE_OWN.value,
|
|
Permission.QUEUE_DELETE_OWN.value,
|
|
Permission.QUEUE_REORDER.value,
|
|
# Library - own items only
|
|
Permission.LIBRARY_READ_OWN.value,
|
|
Permission.LIBRARY_UPLOAD.value,
|
|
Permission.LIBRARY_UPDATE_OWN.value,
|
|
Permission.LIBRARY_DELETE_OWN.value,
|
|
# MakerWorld integration
|
|
Permission.MAKERWORLD_VIEW.value,
|
|
Permission.MAKERWORLD_IMPORT.value,
|
|
# Orca Cloud — needed for the Slice modal's Orca Cloud preset
|
|
# picker to populate. Workshops that use Orca Cloud presets
|
|
# need every operator to be able to authenticate. Bambu Cloud
|
|
# (CLOUD_AUTH) stays admin-only — that one is a more sensitive
|
|
# account binding.
|
|
Permission.ORCA_CLOUD_AUTH.value,
|
|
# Projects - full access
|
|
Permission.PROJECTS_READ.value,
|
|
Permission.PROJECTS_CREATE.value,
|
|
Permission.PROJECTS_UPDATE.value,
|
|
Permission.PROJECTS_DELETE.value,
|
|
# Filaments - full access
|
|
Permission.FILAMENTS_READ.value,
|
|
Permission.FILAMENTS_CREATE.value,
|
|
Permission.FILAMENTS_UPDATE.value,
|
|
Permission.FILAMENTS_DELETE.value,
|
|
# Inventory - full access
|
|
Permission.INVENTORY_READ.value,
|
|
Permission.INVENTORY_CREATE.value,
|
|
Permission.INVENTORY_UPDATE.value,
|
|
Permission.INVENTORY_DELETE.value,
|
|
Permission.INVENTORY_VIEW_ASSIGNMENTS.value,
|
|
Permission.INVENTORY_FORECAST_READ.value,
|
|
Permission.INVENTORY_FORECAST_WRITE.value,
|
|
# Smart Plugs - full access
|
|
Permission.SMART_PLUGS_READ.value,
|
|
Permission.SMART_PLUGS_CREATE.value,
|
|
Permission.SMART_PLUGS_UPDATE.value,
|
|
Permission.SMART_PLUGS_DELETE.value,
|
|
Permission.SMART_PLUGS_CONTROL.value,
|
|
# Camera - view
|
|
Permission.CAMERA_VIEW.value,
|
|
# Maintenance - full access
|
|
Permission.MAINTENANCE_READ.value,
|
|
Permission.MAINTENANCE_CREATE.value,
|
|
Permission.MAINTENANCE_UPDATE.value,
|
|
Permission.MAINTENANCE_DELETE.value,
|
|
# K-Profiles - full access
|
|
Permission.KPROFILES_READ.value,
|
|
Permission.KPROFILES_CREATE.value,
|
|
Permission.KPROFILES_UPDATE.value,
|
|
Permission.KPROFILES_DELETE.value,
|
|
# Notifications - full access
|
|
Permission.NOTIFICATIONS_READ.value,
|
|
Permission.NOTIFICATIONS_CREATE.value,
|
|
Permission.NOTIFICATIONS_UPDATE.value,
|
|
Permission.NOTIFICATIONS_DELETE.value,
|
|
Permission.NOTIFICATIONS_USER_EMAIL.value,
|
|
Permission.NOTIFICATION_TEMPLATES_READ.value,
|
|
Permission.NOTIFICATION_TEMPLATES_UPDATE.value,
|
|
# External Links - full access
|
|
Permission.EXTERNAL_LINKS_READ.value,
|
|
Permission.EXTERNAL_LINKS_CREATE.value,
|
|
Permission.EXTERNAL_LINKS_UPDATE.value,
|
|
Permission.EXTERNAL_LINKS_DELETE.value,
|
|
# Discovery
|
|
Permission.DISCOVERY_SCAN.value,
|
|
# Firmware - read only
|
|
Permission.FIRMWARE_READ.value,
|
|
# Stats & History
|
|
Permission.AMS_HISTORY_READ.value,
|
|
Permission.PRINTER_SENSOR_HISTORY_READ.value,
|
|
Permission.STATS_READ.value,
|
|
Permission.SYSTEM_READ.value,
|
|
# Finance - own visibility
|
|
Permission.COST_CENTERS_READ_OWN.value,
|
|
# Settings - read only
|
|
Permission.SETTINGS_READ.value,
|
|
# Slicer Pipelines - full access
|
|
Permission.PIPELINES_READ.value,
|
|
Permission.PIPELINES_WRITE.value,
|
|
Permission.PIPELINES_RUN.value,
|
|
# WebSocket
|
|
Permission.WEBSOCKET_CONNECT.value,
|
|
],
|
|
"is_system": True,
|
|
},
|
|
"Viewers": {
|
|
"description": "Read-only access to printers, archives, and queue",
|
|
"permissions": [
|
|
# Read-only access
|
|
Permission.PRINTERS_READ.value,
|
|
Permission.ARCHIVES_READ_OWN.value,
|
|
Permission.QUEUE_READ_OWN.value,
|
|
Permission.LIBRARY_READ_OWN.value,
|
|
Permission.PROJECTS_READ.value,
|
|
Permission.FILAMENTS_READ.value,
|
|
Permission.INVENTORY_READ.value,
|
|
Permission.INVENTORY_VIEW_ASSIGNMENTS.value,
|
|
Permission.INVENTORY_FORECAST_READ.value,
|
|
Permission.SMART_PLUGS_READ.value,
|
|
Permission.CAMERA_VIEW.value,
|
|
Permission.MAINTENANCE_READ.value,
|
|
Permission.KPROFILES_READ.value,
|
|
Permission.NOTIFICATIONS_READ.value,
|
|
Permission.NOTIFICATION_TEMPLATES_READ.value,
|
|
Permission.EXTERNAL_LINKS_READ.value,
|
|
Permission.FIRMWARE_READ.value,
|
|
Permission.AMS_HISTORY_READ.value,
|
|
Permission.PRINTER_SENSOR_HISTORY_READ.value,
|
|
Permission.STATS_READ.value,
|
|
Permission.SYSTEM_READ.value,
|
|
Permission.SETTINGS_READ.value,
|
|
# Slicer Pipelines - read only
|
|
Permission.PIPELINES_READ.value,
|
|
Permission.WEBSOCKET_CONNECT.value,
|
|
# MakerWorld browsing only (no import — that writes to library)
|
|
Permission.MAKERWORLD_VIEW.value,
|
|
],
|
|
"is_system": True,
|
|
},
|
|
}
|