maziggy 168d9d8f8e fix(auth): let API keys manage projects via new can_manage_projects scope (#1893) ...

PROJECTS_CREATE/UPDATE/DELETE were in _APIKEY_DENIED_PERMISSIONS with no
entry in _APIKEY_SCOPE_BY_PERMISSION, so every project mutation returned a
generic 403 for any API key regardless of granted permissions -- the same
regression class as archives (#1888) and library (#1832).

Add a per-key can_manage_projects scope. Project routes gate on plain
PROJECTS_* (no OWN/ALL split), so all three CRUD permissions map to the one
scope; membership edits (add-archives) gate on PROJECTS_UPDATE and are
covered. PROJECTS_READ is unchanged (already under can_read_status).

Column defaults TRUE for new keys; existing rows backfill to FALSE so the
upgrade never silently widens scope. Migration is BOOLEAN (SQLite + Postgres
safe), verified on fresh SQLite and Postgres 17. Bundled SpoolBuddy kiosk key
set to False. Settings API-key UI gets a Manage Projects toggle + Projects
badge; 11-locale i18n. RBAC scope matrix + drift guards extended.

2026-07-05 09:58:16 +02:00

..

assets

fix(auth): let API keys manage projects via new can_manage_projects scope (#1893)

2026-07-05 09:58:16 +02:00

fonts

Post work PR #1505

2026-06-17 11:38:07 +02:00

icons

Post work PR #1505

2026-06-17 11:38:07 +02:00

img

feat(gcode-injection): per-VP opt-in auto-print injection toggle (#1516) (#1656)

2026-06-19 11:29:07 +02:00

index.html

fix(auth): let API keys manage projects via new can_manage_projects scope (#1893)

2026-07-05 09:58:16 +02:00

manifest.json

Post work PR #1505

2026-06-17 11:38:07 +02:00

spoolbuddy_logo_dark.png

Post work PR #1505

2026-06-17 11:38:07 +02:00

sw-register.js

Post work PR #1505

2026-06-17 11:38:07 +02:00

sw.js

Post work PR #1505

2026-06-17 11:38:07 +02:00

vite.svg

Post work PR #1505

2026-06-17 11:38:07 +02:00