From 731ea83560593398a24e9b06a45ff828d1d67795 Mon Sep 17 00:00:00 2001 From: nfebe Date: Sat, 22 Aug 2026 23:35:14 +0100 Subject: [PATCH 01/11] fix(fleet): Open peer deployment details Peer deployment cards now open a compact read-only overview. Failed peer requests show the response returned by the server. --- src/components/RemoteDeploymentOverview.vue | 228 ++++++++++++++++++++ src/services/api.ts | 7 + src/views/DeploymentDetailView.test.ts | 32 ++- src/views/DeploymentDetailView.vue | 24 ++- src/views/DeploymentsView.test.ts | 3 + src/views/DeploymentsView.vue | 20 +- 6 files changed, 299 insertions(+), 15 deletions(-) create mode 100644 src/components/RemoteDeploymentOverview.vue diff --git a/src/components/RemoteDeploymentOverview.vue b/src/components/RemoteDeploymentOverview.vue new file mode 100644 index 0000000..72c0346 --- /dev/null +++ b/src/components/RemoteDeploymentOverview.vue @@ -0,0 +1,228 @@ + + + + + diff --git a/src/services/api.ts b/src/services/api.ts index c1b2cc4..2b3fd34 100755 --- a/src/services/api.ts +++ b/src/services/api.ts @@ -2144,6 +2144,13 @@ export const clusterApi = { apiClient.post("/cluster/accept", { invite_token: inviteToken, peer_url: peerUrl }), removePeer: (name: string) => apiClient.delete<{ status: string; peer: string }>(`/cluster/peers/${name}`), getAggregatedDeployments: () => apiClient.get("/cluster/deployments"), + getDeployment: (server: string, name: string) => + apiClient.get<{ + deployment: Deployment; + compose_content?: string; + compose_filename?: string; + proxy_status?: unknown; + }>(`/cluster/peers/${encodeURIComponent(server)}/proxy/deployments/${encodeURIComponent(name)}`), deploymentAction: (server: string, name: string, action: "start" | "stop" | "restart") => apiClient.post( `/cluster/peers/${encodeURIComponent(server)}/proxy/deployments/${encodeURIComponent(name)}/${action}`, diff --git a/src/views/DeploymentDetailView.test.ts b/src/views/DeploymentDetailView.test.ts index 69a6a9a..ca9a833 100644 --- a/src/views/DeploymentDetailView.test.ts +++ b/src/views/DeploymentDetailView.test.ts @@ -6,7 +6,7 @@ import { useAuthStore } from "@/stores/auth"; const mockRoute = { params: { name: "test-app" }, - query: {}, + query: {} as Record, }; vi.mock("vue-router", () => ({ @@ -18,6 +18,21 @@ vi.mock("vue-router", () => ({ })); vi.mock("@/services/api", () => ({ + clusterApi: { + getDeployment: vi.fn().mockResolvedValue({ + data: { + deployment: { + name: "test-app", + status: "running", + path: "/deployments/test-app", + services: [{ name: "web", status: "running", container_id: "abc123", image: "nginx:1.27" }], + created_at: "2024-01-01T00:00:00Z", + updated_at: "2024-01-01T00:00:00Z", + }, + proxy_status: { exposed: true, domain: "test-app.example.com", ssl_enabled: true }, + }, + }), + }, deploymentsApi: { get: vi.fn().mockResolvedValue({ data: { @@ -135,6 +150,7 @@ describe("DeploymentDetailView", () => { beforeEach(() => { vi.clearAllMocks(); vi.useFakeTimers(); + mockRoute.query = {}; }); afterEach(() => { @@ -178,6 +194,20 @@ describe("DeploymentDetailView", () => { expect(wrapper.find(".detail-header").exists()).toBe(true); }); + it("loads peer deployment details and shows the peer context", async () => { + const { clusterApi, deploymentsApi } = await import("@/services/api"); + mockRoute.query = { server: "prod-2" }; + const wrapper = mountView(); + await flushPromises(); + + expect(clusterApi.getDeployment).toHaveBeenCalledWith("prod-2", "test-app"); + expect(deploymentsApi.get).not.toHaveBeenCalled(); + expect(wrapper.text()).toContain("Managed on"); + expect(wrapper.text()).toContain("prod-2"); + expect(wrapper.text()).toContain("nginx:1.27"); + expect(wrapper.find(".detail-tabs").exists()).toBe(false); + }); + it("contains detail tabs section", async () => { const wrapper = mountView(); await flushPromises(); diff --git a/src/views/DeploymentDetailView.vue b/src/views/DeploymentDetailView.vue index eaabb88..7d639a3 100755 --- a/src/views/DeploymentDetailView.vue +++ b/src/views/DeploymentDetailView.vue @@ -13,7 +13,7 @@ -
+
Diagnose Try Again
+ + @@ -327,7 +322,7 @@ import { RotateCw, FileText, Inbox, - Settings, + Eye, ExternalLink, Globe, Database, @@ -465,7 +460,10 @@ const onDeploymentCreated = () => { }; const goToDeployment = (deployment: ManagedDeployment) => { - if (deployment.local) router.push(`/deployments/${deployment.name}`); + router.push({ + path: `/deployments/${encodeURIComponent(deployment.name)}`, + query: deployment.local ? {} : { server: deployment.server }, + }); }; const getServiceClass = (service: Service) => { From 7c310aa3e0bc510eeae1a4ee62e58e47ce14c016 Mon Sep 17 00:00:00 2001 From: nfebe Date: Sat, 22 Aug 2026 23:58:38 +0100 Subject: [PATCH 02/11] fix(auth): Preserve scoped user access Users can load assigned deployments without Fleet access. Service pages and controls now follow their independent read, write, and delete permissions. --- src/components/NotificationsSettings.test.ts | 15 ++++++++- src/components/NotificationsSettings.vue | 3 +- src/components/PermissionPicker.test.ts | 6 +++- src/components/PermissionPicker.vue | 34 ++++++++++++++++++++ src/components/StorageBackupsSettings.vue | 4 +-- src/layouts/DashboardLayout.vue | 8 +++-- src/router/index.ts | 8 ++--- src/services/api.ts | 1 + src/types/index.ts | 5 +++ src/views/DeploymentsView.test.ts | 33 +++++++++++++++++++ src/views/DeploymentsView.vue | 8 +++++ src/views/ObjectBucketView.vue | 2 +- src/views/ObjectStoreDetailView.vue | 10 +++--- src/views/ObjectStoresView.vue | 6 ++-- 14 files changed, 122 insertions(+), 21 deletions(-) diff --git a/src/components/NotificationsSettings.test.ts b/src/components/NotificationsSettings.test.ts index e357aab..cf02804 100644 --- a/src/components/NotificationsSettings.test.ts +++ b/src/components/NotificationsSettings.test.ts @@ -2,8 +2,9 @@ import { flushPromises, mount } from "@vue/test-utils"; import { beforeEach, describe, expect, it, vi } from "vitest"; import NotificationsSettings from "./NotificationsSettings.vue"; +const hasPermission = vi.fn((_permission: string) => true); vi.mock("@/stores/auth", () => ({ - useAuthStore: () => ({ hasPermission: () => true }), + useAuthStore: () => ({ hasPermission }), })); vi.mock("@/stores/notifications", () => ({ @@ -25,6 +26,7 @@ describe("NotificationsSettings", () => { beforeEach(async () => { window.history.replaceState({}, "", "/"); vi.clearAllMocks(); + hasPermission.mockReturnValue(true); const { notificationsApi } = await import("@/services/api"); vi.mocked(notificationsApi.getTargets).mockResolvedValue({ data: { targets: [{ id: "ops", name: "Operations", url: "********", kind: "email", enabled: true }] }, @@ -157,4 +159,15 @@ describe("NotificationsSettings", () => { expect(wrapper.text()).toContain("The node stopped responding."); expect(wrapper.text()).toContain("inc-42"); }); + + it("keeps notification readers out of mutation controls", async () => { + hasPermission.mockImplementation((permission: string) => permission === "notifications:read"); + const wrapper = mountSettings(); + await flushPromises(); + + await wrapper.findAll(".section-tabs button")[2].trigger("click"); + expect(wrapper.text()).not.toContain("Add target"); + expect(wrapper.text()).not.toContain("Test"); + expect(wrapper.text()).toContain("View"); + }); }); diff --git a/src/components/NotificationsSettings.vue b/src/components/NotificationsSettings.vue index d604791..7f2e242 100644 --- a/src/components/NotificationsSettings.vue +++ b/src/components/NotificationsSettings.vue @@ -154,6 +154,7 @@ >{{ kindOf(target) }}
("incidents"); const targets = ref([]); const rules = ref([]); diff --git a/src/components/PermissionPicker.test.ts b/src/components/PermissionPicker.test.ts index 3b56086..307de76 100644 --- a/src/components/PermissionPicker.test.ts +++ b/src/components/PermissionPicker.test.ts @@ -11,7 +11,7 @@ describe("PermissionPicker", () => { it("renders all permission groups", () => { const wrapper = mountPicker({ modelValue: [] }); const groups = wrapper.findAll(".permission-group"); - expect(groups.length).toBe(20); + expect(groups.length).toBe(24); }); it("displays group labels", () => { @@ -21,6 +21,10 @@ describe("PermissionPicker", () => { expect(text).toContain("Containers"); expect(text).toContain("Databases"); expect(text).toContain("Infrastructure"); + expect(text).toContain("Object Storage"); + expect(text).toContain("Notifications"); + expect(text).toContain("Fleet"); + expect(text).toContain("Configuration"); expect(text).toContain("DNS"); expect(text).toContain("Audit"); }); diff --git a/src/components/PermissionPicker.vue b/src/components/PermissionPicker.vue index b210319..35cf35b 100644 --- a/src/components/PermissionPicker.vue +++ b/src/components/PermissionPicker.vue @@ -130,6 +130,7 @@ const permissionGroups: PermissionGroup[] = [ permissions: [ { value: "system:read", label: "Read", level: "read" }, { value: "system:write", label: "Write", level: "write" }, + { value: "system:files", label: "Files", level: "write" }, ], }, { @@ -200,6 +201,31 @@ const permissionGroups: PermissionGroup[] = [ { value: "backups:delete", label: "Delete", level: "delete" }, ], }, + { + key: "storage", + label: "Object Storage", + permissions: [ + { value: "storage:read", label: "Read", level: "read" }, + { value: "storage:write", label: "Write", level: "write" }, + { value: "storage:delete", label: "Delete", level: "delete" }, + ], + }, + { + key: "notifications", + label: "Notifications", + permissions: [ + { value: "notifications:read", label: "Read", level: "read" }, + { value: "notifications:write", label: "Write", level: "write" }, + ], + }, + { + key: "cluster", + label: "Fleet", + permissions: [ + { value: "cluster:read", label: "Read", level: "read" }, + { value: "cluster:write", label: "Write", level: "write" }, + ], + }, { key: "users", label: "Users", @@ -226,6 +252,14 @@ const permissionGroups: PermissionGroup[] = [ { value: "settings:write", label: "Write", level: "write" }, ], }, + { + key: "config", + label: "Configuration", + permissions: [ + { value: "config:read", label: "Read", level: "read" }, + { value: "config:write", label: "Write", level: "write" }, + ], + }, { key: "audit", label: "Audit", diff --git a/src/components/StorageBackupsSettings.vue b/src/components/StorageBackupsSettings.vue index 8751598..74c8e19 100644 --- a/src/components/StorageBackupsSettings.vue +++ b/src/components/StorageBackupsSettings.vue @@ -177,8 +177,8 @@ import { useNotificationsStore } from "@/stores/notifications"; const auth = useAuthStore(); const notifications = useNotificationsStore(); -const canWriteCreds = auth.hasPermission("backups:write"); -const canDeleteCreds = auth.hasPermission("backups:delete"); +const canWriteCreds = auth.hasPermission("storage:write"); +const canDeleteCreds = auth.hasPermission("storage:delete"); const canWriteDests = auth.hasPermission("config:write"); const creds = ref([]); diff --git a/src/layouts/DashboardLayout.vue b/src/layouts/DashboardLayout.vue index 54311e5..0f0e576 100644 --- a/src/layouts/DashboardLayout.vue +++ b/src/layouts/DashboardLayout.vue @@ -205,7 +205,7 @@
@@ -233,7 +233,7 @@ {{ stats.databases }} { }; const fetchClusterInfo = async () => { + if (!authStore.hasPermission("cluster:read")) return; try { const res = await clusterApi.getStatus(); if (res.data.enabled && res.data.server_name) { diff --git a/src/router/index.ts b/src/router/index.ts index 41fd184..a040c0c 100644 --- a/src/router/index.ts +++ b/src/router/index.ts @@ -98,19 +98,19 @@ const routes: RouteRecordRaw[] = [ path: "storage/object-stores", name: "object-stores", component: () => import("@/views/ObjectStoresView.vue"), - meta: { permission: "backups:read" }, + meta: { permission: "storage:read" }, }, { path: "storage/object-stores/:name", name: "object-store-detail", component: () => import("@/views/ObjectStoreDetailView.vue"), - meta: { permission: "backups:read" }, + meta: { permission: "storage:read" }, }, { path: "storage/object-stores/:name/buckets/:bucket", name: "object-store-bucket", component: () => import("@/views/ObjectBucketView.vue"), - meta: { permission: "backups:read" }, + meta: { permission: "storage:read" }, }, { path: "certificates", @@ -220,7 +220,7 @@ const routes: RouteRecordRaw[] = [ path: "notifications", name: "notifications", component: () => import("@/views/NotificationsView.vue"), - meta: { permission: "settings:read" }, + meta: { permission: "notifications:read" }, }, { path: "security", diff --git a/src/services/api.ts b/src/services/api.ts index 2b3fd34..7ad6c5c 100755 --- a/src/services/api.ts +++ b/src/services/api.ts @@ -1403,6 +1403,7 @@ export interface StoreBucket { } export const objectStoresApi = { + list: () => apiClient.get<{ destinations: BackupDestination[] }>("/object-stores"), listBuckets: (name: string) => apiClient.get<{ buckets: StoreBucket[]; backup_bucket: string }>( `/object-stores/${encodeURIComponent(name)}/buckets`, diff --git a/src/types/index.ts b/src/types/index.ts index 98578ed..7a5a5e7 100644 --- a/src/types/index.ts +++ b/src/types/index.ts @@ -394,6 +394,11 @@ export type Permission = | "backups:read" | "backups:write" | "backups:delete" + | "storage:read" + | "storage:write" + | "storage:delete" + | "notifications:read" + | "notifications:write" | "users:read" | "users:write" | "users:delete" diff --git a/src/views/DeploymentsView.test.ts b/src/views/DeploymentsView.test.ts index e10a11d..1776e4a 100644 --- a/src/views/DeploymentsView.test.ts +++ b/src/views/DeploymentsView.test.ts @@ -126,6 +126,28 @@ describe("DeploymentsView", () => { }); }; + const mountViewWithPermissions = (permissions: string[]) => { + const pinia = createTestingPinia({ createSpy: vi.fn }); + const authStore = useAuthStore(pinia); + (authStore.hasPermission as ReturnType).mockImplementation((permission: string) => + permissions.includes(permission), + ); + return mount(DeploymentsView, { + global: { + plugins: [pinia], + stubs: { + DataTable: { + template: `
`, + props: ["items", "columns", "loading"], + }, + OperationModal: true, + LogsModal: true, + NewDeploymentModal: true, + }, + }, + }); + }; + describe("View structure", () => { it("renders the deployments view container", () => { const wrapper = mountView(); @@ -167,6 +189,17 @@ describe("DeploymentsView", () => { expect(deploymentsApi.list).toHaveBeenCalled(); }); + it("loads assigned deployments without requesting Fleet access", async () => { + const { clusterApi, deploymentsApi } = await import("@/services/api"); + const wrapper = mountViewWithPermissions(["deployments:read"]); + await flushPromises(); + + expect(clusterApi.getStatus).not.toHaveBeenCalled(); + expect(clusterApi.getAggregatedDeployments).not.toHaveBeenCalled(); + expect(deploymentsApi.list).toHaveBeenCalledOnce(); + expect(wrapper.text()).toContain("my-laravel-app"); + }); + it("filters the aggregate inventory by the selected server", async () => { const { clusterApi } = await import("@/services/api"); mockRoute.query = { server: "prod-2" }; diff --git a/src/views/DeploymentsView.vue b/src/views/DeploymentsView.vue index ff308c9..1da1ffc 100644 --- a/src/views/DeploymentsView.vue +++ b/src/views/DeploymentsView.vue @@ -341,6 +341,7 @@ const route = useRoute(); const notifications = useNotificationsStore(); const authStore = useAuthStore(); const canWrite = authStore.hasPermission("deployments:write"); +const canReadCluster = authStore.hasPermission("cluster:read"); type ManagedDeployment = Deployment & { server: string; local: boolean; clusterKey: string }; const deployments = ref([]); const localServer = ref("This server"); @@ -381,6 +382,13 @@ const columns = [ const fetchDeployments = async () => { loading.value = true; try { + if (!canReadCluster) { + const response = await deploymentsApi.list(); + deployments.value = (response.data.deployments || []).map((deployment) => + managedDeployment(deployment, localServer.value, true), + ); + return; + } const status = await clusterApi.getStatus(); if (!status.data.enabled) { const response = await deploymentsApi.list(); diff --git a/src/views/ObjectBucketView.vue b/src/views/ObjectBucketView.vue index b51adb9..3e22baa 100644 --- a/src/views/ObjectBucketView.vue +++ b/src/views/ObjectBucketView.vue @@ -113,7 +113,7 @@ const route = useRoute(); const router = useRouter(); const notifications = useNotificationsStore(); const auth = useAuthStore(); -const canWrite = auth.hasPermission("backups:write"); +const canWrite = auth.hasPermission("storage:write"); const name = route.params.name as string; const bucket = route.params.bucket as string; diff --git a/src/views/ObjectStoreDetailView.vue b/src/views/ObjectStoreDetailView.vue index 1b885ca..e3e4eef 100644 --- a/src/views/ObjectStoreDetailView.vue +++ b/src/views/ObjectStoreDetailView.vue @@ -120,7 +120,7 @@ import BaseInput from "@/components/base/BaseInput.vue"; import AttachStoreModal from "@/components/AttachStoreModal.vue"; import ReplicateStoreModal from "@/components/ReplicateStoreModal.vue"; import ConfirmModal from "@/components/ConfirmModal.vue"; -import { backupDestinationsApi, objectStoresApi, type BackupDestination, type StoreBucket } from "@/services/api"; +import { objectStoresApi, type BackupDestination, type StoreBucket } from "@/services/api"; import { useNotificationsStore } from "@/stores/notifications"; import { useAuthStore } from "@/stores/auth"; @@ -128,9 +128,9 @@ const route = useRoute(); const router = useRouter(); const notifications = useNotificationsStore(); const auth = useAuthStore(); -const canWrite = auth.hasPermission("backups:write"); -const canDelete = auth.hasPermission("backups:delete"); -const canManage = auth.hasPermission("backups:write") || auth.hasPermission("config:write"); +const canWrite = auth.hasPermission("storage:write"); +const canDelete = auth.hasPermission("storage:delete"); +const canManage = auth.hasPermission("storage:write"); const name = route.params.name as string; const store = ref(null); @@ -149,7 +149,7 @@ const kind = computed(() => store.value?.kind || "external"); onMounted(async () => { try { - const res = await backupDestinationsApi.list(); + const res = await objectStoresApi.list(); store.value = (res.data.destinations || []).find((d) => d.name === name) || null; } catch (e: any) { notifications.error("Could not load store", e.response?.data?.error || e.message); diff --git a/src/views/ObjectStoresView.vue b/src/views/ObjectStoresView.vue index 2ae0b42..239059d 100644 --- a/src/views/ObjectStoresView.vue +++ b/src/views/ObjectStoresView.vue @@ -86,12 +86,12 @@ import BaseCard from "@/components/base/BaseCard.vue"; import BaseButton from "@/components/base/BaseButton.vue"; import StorageBackupsSettings from "@/components/StorageBackupsSettings.vue"; import DeployObjectStoreModal from "@/components/DeployObjectStoreModal.vue"; -import { backupDestinationsApi, type BackupDestination } from "@/services/api"; +import { objectStoresApi, type BackupDestination } from "@/services/api"; import { useAuthStore } from "@/stores/auth"; const router = useRouter(); const auth = useAuthStore(); -const canManage = auth.hasPermission("backups:write") || auth.hasPermission("config:write"); +const canManage = auth.hasPermission("storage:write"); const showDeployModal = ref(false); @@ -124,7 +124,7 @@ const loading = ref(true); async function load() { loading.value = true; try { - const res = await backupDestinationsApi.list(); + const res = await objectStoresApi.list(); destinations.value = res.data.destinations || []; } catch { destinations.value = []; From 9623f6d1a4e1ece925c2d00e637a8464127c2201 Mon Sep 17 00:00:00 2001 From: nfebe Date: Sun, 23 Aug 2026 00:01:37 +0100 Subject: [PATCH 03/11] fix(deployments): Bypass Fleet for local inventory The default deployment view now loads directly from the local server, so Fleet availability cannot hide stopped or unhealthy deployments. --- src/views/DeploymentsView.test.ts | 34 ++++++++----------------------- src/views/DeploymentsView.vue | 2 +- 2 files changed, 10 insertions(+), 26 deletions(-) diff --git a/src/views/DeploymentsView.test.ts b/src/views/DeploymentsView.test.ts index 1776e4a..a98f0e6 100644 --- a/src/views/DeploymentsView.test.ts +++ b/src/views/DeploymentsView.test.ts @@ -182,11 +182,13 @@ describe("DeploymentsView", () => { }); describe("Data loading", () => { - it("fetches deployments on mount", async () => { - const { deploymentsApi } = await import("@/services/api"); + it("loads local deployments without requesting Fleet status", async () => { + const { clusterApi, deploymentsApi } = await import("@/services/api"); mountView(); await flushPromises(); expect(deploymentsApi.list).toHaveBeenCalled(); + expect(clusterApi.getStatus).not.toHaveBeenCalled(); + expect(clusterApi.getAggregatedDeployments).not.toHaveBeenCalled(); }); it("loads assigned deployments without requesting Fleet access", async () => { @@ -235,33 +237,15 @@ describe("DeploymentsView", () => { expect(mockPush).toHaveBeenCalledWith({ path: "/deployments/remote-app", query: { server: "prod-2" } }); }); - it("shows only local deployments when no peer is selected", async () => { + it("shows stopped local deployments without Fleet checks", async () => { const { clusterApi } = await import("@/services/api"); - vi.mocked(clusterApi.getStatus).mockResolvedValueOnce({ - data: { enabled: true, server_name: "prod-1" }, - } as any); - vi.mocked(clusterApi.getAggregatedDeployments).mockResolvedValueOnce({ - data: { - servers: { - "prod-1": { - name: "prod-1", - online: true, - data: { deployments: [{ name: "local-app", status: "running", services: [] }] }, - }, - "prod-2": { - name: "prod-2", - online: true, - data: { deployments: [{ name: "remote-app", status: "running", services: [] }] }, - }, - }, - }, - } as any); - const wrapper = mountView(); await flushPromises(); - expect(wrapper.text()).toContain("local-app"); - expect(wrapper.text()).not.toContain("remote-app"); + expect(wrapper.text()).toContain("wordpress-site"); + expect(wrapper.text()).toContain("stopped"); + expect(clusterApi.getStatus).not.toHaveBeenCalled(); + expect(clusterApi.getAggregatedDeployments).not.toHaveBeenCalled(); expect(wrapper.find(".server-context").exists()).toBe(false); }); }); diff --git a/src/views/DeploymentsView.vue b/src/views/DeploymentsView.vue index 1da1ffc..1e70390 100644 --- a/src/views/DeploymentsView.vue +++ b/src/views/DeploymentsView.vue @@ -382,7 +382,7 @@ const columns = [ const fetchDeployments = async () => { loading.value = true; try { - if (!canReadCluster) { + if (!selectedServer.value || !canReadCluster) { const response = await deploymentsApi.list(); deployments.value = (response.data.deployments || []).map((deployment) => managedDeployment(deployment, localServer.value, true), From cebcb979dc36e0177b37090318db90ccf357a52c Mon Sep 17 00:00:00 2001 From: nfebe Date: Sun, 23 Aug 2026 04:33:05 +0100 Subject: [PATCH 04/11] fix(release): Move Albacore to beta 6 --- CHANGELOG.md | 7 ++++++- package-lock.json | 4 ++-- package.json | 2 +- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 9b79f3e..cc9884d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,6 @@ # Changelog -## [0.4.0-beta.5] - 2026-08-22 +## [0.4.0-beta.6] - 2026-08-23 ### Added - Guided Fleet setup, peer access controls, runtime provider selection, and remote deployment inventories @@ -11,6 +11,11 @@ - Deployments show the selected server in the navigation and remain local by default - Deployment configuration keeps scaling beside settings while service image changes remain in the overview +### Fixed +- Assigned local deployments load without Fleet access or Fleet availability +- Peer deployment details open for users with read access +- Object storage and notifications follow their dedicated permissions + ## [0.4.0-beta.4] - 2026-08-21 ### Added diff --git a/package-lock.json b/package-lock.json index 27210da..c08f303 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "@flatrun/ui", - "version": "0.4.0-beta.5", + "version": "0.4.0-beta.6", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@flatrun/ui", - "version": "0.4.0-beta.5", + "version": "0.4.0-beta.6", "license": "MIT", "dependencies": { "@codemirror/lang-sql": "^6.10.0", diff --git a/package.json b/package.json index 3684a89..d834d38 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@flatrun/ui", - "version": "0.4.0-beta.5", + "version": "0.4.0-beta.6", "description": "Web interface for FlatRun container orchestration", "author": "FlatRun", "license": "MIT", From 02b7eab2493e187b87b0c4c9f11955c5b9c4a500 Mon Sep 17 00:00:00 2001 From: nfebe Date: Sun, 23 Aug 2026 04:51:59 +0100 Subject: [PATCH 05/11] fix(settings): Clarify limited administration access Administration navigation follows dedicated permissions. Read-only Settings controls remain clear and legible in dark mode. --- CHANGELOG.md | 2 + src/components/PermissionPicker.test.ts | 3 +- src/components/PermissionPicker.vue | 8 +++ src/layouts/DashboardLayout.vue | 2 +- src/router/index.ts | 2 +- src/types/index.ts | 2 + src/views/SettingsView.test.ts | 24 +++++++++ src/views/SettingsView.vue | 69 ++++++++++++++++++++++--- src/views/UpdatesView.vue | 4 +- 9 files changed, 105 insertions(+), 11 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index cc9884d..fc7e91d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -15,6 +15,8 @@ - Assigned local deployments load without Fleet access or Fleet availability - Peer deployment details open for users with read access - Object storage and notifications follow their dedicated permissions +- Operators no longer see Updates unless access is explicitly granted +- Read-only Settings access is clearly identified and its controls remain legible in dark mode ## [0.4.0-beta.4] - 2026-08-21 diff --git a/src/components/PermissionPicker.test.ts b/src/components/PermissionPicker.test.ts index 307de76..44a9b27 100644 --- a/src/components/PermissionPicker.test.ts +++ b/src/components/PermissionPicker.test.ts @@ -11,7 +11,7 @@ describe("PermissionPicker", () => { it("renders all permission groups", () => { const wrapper = mountPicker({ modelValue: [] }); const groups = wrapper.findAll(".permission-group"); - expect(groups.length).toBe(24); + expect(groups.length).toBe(25); }); it("displays group labels", () => { @@ -25,6 +25,7 @@ describe("PermissionPicker", () => { expect(text).toContain("Notifications"); expect(text).toContain("Fleet"); expect(text).toContain("Configuration"); + expect(text).toContain("Updates"); expect(text).toContain("DNS"); expect(text).toContain("Audit"); }); diff --git a/src/components/PermissionPicker.vue b/src/components/PermissionPicker.vue index 35cf35b..6363ee6 100644 --- a/src/components/PermissionPicker.vue +++ b/src/components/PermissionPicker.vue @@ -260,6 +260,14 @@ const permissionGroups: PermissionGroup[] = [ { value: "config:write", label: "Write", level: "write" }, ], }, + { + key: "updates", + label: "Updates", + permissions: [ + { value: "updates:read", label: "Read", level: "read" }, + { value: "updates:write", label: "Install", level: "write" }, + ], + }, { key: "audit", label: "Audit", diff --git a/src/layouts/DashboardLayout.vue b/src/layouts/DashboardLayout.vue index 0f0e576..a3ded1c 100644 --- a/src/layouts/DashboardLayout.vue +++ b/src/layouts/DashboardLayout.vue @@ -474,7 +474,7 @@ Settings import("@/views/UpdatesView.vue"), - meta: { permission: "settings:read" }, + meta: { permission: "updates:read" }, }, { path: "system-terminal", diff --git a/src/types/index.ts b/src/types/index.ts index 7a5a5e7..d2d2bf3 100644 --- a/src/types/index.ts +++ b/src/types/index.ts @@ -407,6 +407,8 @@ export type Permission = | "apikeys:delete" | "settings:read" | "settings:write" + | "updates:read" + | "updates:write" | "config:read" | "config:write" | "audit:read" diff --git a/src/views/SettingsView.test.ts b/src/views/SettingsView.test.ts index 745ac71..2d084b2 100644 --- a/src/views/SettingsView.test.ts +++ b/src/views/SettingsView.test.ts @@ -83,6 +83,19 @@ describe("SettingsView", () => { }); }; + const mountViewWithPermissions = (permissions: string[]) => { + const pinia = createTestingPinia({ createSpy: vi.fn }); + const authStore = useAuthStore(pinia); + (authStore.hasPermission as ReturnType).mockImplementation((permission: string) => + permissions.includes(permission), + ); + return mount(SettingsView, { + global: { + plugins: [pinia], + }, + }); + }; + describe("View structure", () => { it("renders the settings view container", () => { const wrapper = mountView(); @@ -94,6 +107,17 @@ describe("SettingsView", () => { expect(wrapper.find(".view-header").exists()).toBe(true); expect(wrapper.find(".tabs").exists()).toBe(true); }); + + it("explains limited access and locks assistant settings for readers", async () => { + const wrapper = mountViewWithPermissions(["settings:read"]); + expect(wrapper.text()).toContain("You have limited access"); + + const aiTab = wrapper.findAll(".tab").find((tab) => tab.text().includes("AI Assistant")); + await aiTab?.trigger("click"); + + const baseURL = wrapper.find('input[placeholder="https://api.openai.com/v1"]'); + expect(baseURL.attributes("disabled")).toBeDefined(); + }); }); describe("Tab navigation", () => { diff --git a/src/views/SettingsView.vue b/src/views/SettingsView.vue index 9fae014..aefa5af 100644 --- a/src/views/SettingsView.vue +++ b/src/views/SettingsView.vue @@ -29,6 +29,10 @@
+ + You have limited access. Read-only controls are locked; settings you are allowed to manage remain available. + +