Repository navigation
Dev - #31
Open
Shaan-Shoukath wants to merge 881 commits into
Open
Dev#31Shaan-Shoukath wants to merge 881 commits into
Shaan-Shoukath wants to merge 881 commits into
Conversation
…anner A Security tab for the Space Manager and the superadmin (hub entry, sidebar, platform tabs): staff sign-in requirements with a "Locked by platform: <note>" badge, lock/unlock for superadmins, and the PII access banner (superadmin opens/closes a reasoned 30-minute window; the Space Manager sees open windows read-only). Security keys leave the generic Features list. Clients are hand-typed until the coordinator regenerates api.ts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…admin PII access Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… scan panel re-renders (#95 inline callback reset the upload) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…pient_selection Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…object key; drop a stale non-`_key` entry Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ion and the superadmin-access write path (#110/#111) Every archive is now encrypted to the platform key alone. Deletes recipient enrolment/challenge/lifecycle views, custody state and alarm outboxes, B1 activation, the toggle write path in the makerspace serializer, the /control/ slim hidden row and money-omission branches, and the custody readiness and beat tasks. backup/0030 drops the tables in FK order (and backup_reject_reservation_ mutation), 0031 drops the BackupArchive decision snapshot. Managers get a read-only backup-status line instead of the custody read. Space packs keep the target's security.* features. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…y; drop tenant-exit custody (#111 Q7) export_portable_tenant_dump takes --recipient (repeatable). The canonical keys are frozen on the capture for this export only; the outer envelope always adds the platform key and the DEK envelope stays tenant-only. Removes custody locks, recipient-change refusal, alarm intents, the target recipient-challenge proof and custody readiness, and the BK-66 platform-custody guard. tenant_migration/ 0013 drops TenantDumpCapture.superadmin_access_at_decision; the derivation policy version is 6. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…eservations and the compound restore coordinator (#111 Q8) With superadmin always on no makerspace is sovereign, so a deployment archive is one platform-readable component: the readable main is still projected and verified, but slice capture/sealing/rewrap, reservation and fence capture, the source-partition proof, reconstruction verifier, delayed slice merge, not- restored component state and the E9b coordinator are gone. The signed manifest is protocol v2 (single component); restore refuses a legacy partial archive. backup/0032 drops every backup_b1_* function (CASCADE), removes the B1 branch from accounts_guard_context and drops the four B1 tables in FK order. Servability and the tenant gates lose their not-restored halves. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…urfaces (#111 Q2) Removes the backup ModuleDefinition, group, profile entries, always-on setup area, purge plan and uninstall gate; backup/0033 strips the key from every makerspace. Makerspace archive listing, requests and downloads are superadmin- only; managers see a read-only Last backup line (dashboard and Backup & restore page) and use data export for their own copy. The settings panel drops the superadmin-access toggle and the create-makerspace form stops sending it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…recipients; drop recipient authority entries The column holds one-shot --recipient keys for one export, not a frozen custody set; tenant_migration/0013 renames it. The dropped archive-recipient model no longer needs authority-projection entries. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… archive, one-shot tenant-exit recipients, backup module retired INVARIANTS drops the custody, activation, recipient and Lane E E6-E9b sections and rewrites D3/D4/D5; MODULES/MODULES-PLATFORM retire the backup key; README, landing positioning, source maps, project status, notification docs and the CLAUDE.md = AGENTS.md index rows follow. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Depending on accounts/0035 pinned the backup graph to the accounts leaf and broke plans that move accounts alone. The dead B1 branch in accounts_guard_context is inert (it needs a role nothing creates) and is left to an accounts migration. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…te participant (#95) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ord cannot be read Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…nd stay unmasked (#114) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ivery Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
vite 8.1.3 -> 8.1.6, vitest 4.1.10 -> 4.1.12 (@vitest/mocker 4.1.12), postcss 8.5.16 -> 8.5.23, react-router-dom/react-router 7.18.1 -> 7.18.2; transitive undici 7.28.0 -> 7.30.1 (jsdom) and source-map-js 1.2.1 -> 1.2.2. xlsx has no patched release on npm and is left for an owner decision. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…nnot drift Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ute, with tenant PII masked outside a window (#115) surface_policy admits a platform superadmin to every membership-only and delegable staff route outside /api/v1/auth/; each route's RBAC, module gates, re-auth and audit still decide. PlatformTenantPiiMiddleware masks person data in those responses (pii_seam is fail-closed until Lane C's window merges) and a JSON write carrying the mask is refused. /auth/me carries superadmin_actions. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…nts' websites (#115) reject_platform(actor, tenant=True) admits the platform superadmin on space-owned page content under the same fences and audit; organization pages stay owner-only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…in the staff console (#115 b2) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ce Manager does, and compares spaces (#115) Inside a chosen space the superadmin holds superadmin_actions, so the console shows that space's Space-Manager tabs (search and job tray included) beside the platform tabs; ?context=platform&space=<slug> opens a space directly; the public page builder is shown; the platform dashboard gains a per-space comparison with totals and an Open reports link per space. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… status Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… superadmin (#111 Q12, #115) Same gate Lane C adds in report_subjects, routed through pii_seam so it is fail-closed on this branch; at merge keep Lane C's hunk. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…n risks Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…nd that person data is masked (#115) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…efund case again The post-commit charge helper skipped already-cancelled rows, so a single cancel never assessed its settled charge (regressed by b12d3d1). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…cked, not ok Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…aging (device-staff-grant, frozen auth payload); CATALOG unchanged Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…rations sections, palette swatches; drop the contributors wall Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… Outlook, .ics downloads and booking feeds Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…-source makerspace management accent; rounded banner corners Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…, tagline, any-machine and integrations sections, palette swatches Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…default machines.integrations switch (L10, #76) MachineTypeIntegration binds a device integration kind (only printer_agent is reserved) to a machine type in one space, created disabled; PrinterStatusSnapshot keeps a printer's latest bounded status, one row per device. The capability sits under machines, needs devices and machine_service, defaults off and stays out of the console (deferred). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ions for the L10 models Both integration models are omitted from exports and tenant dumps (a moved device re-enrolls and is re-bound); their audit ids remap through the travelling rows, and the binding creator is a mutable attribution in the merge registry. CATALOG_SCHEMA_SHA256 is left for the coordinator. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…e printer protocol and SOURCE-MAP Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…status snapshot, 404 while off (L10, #76) Signed printer routes on the existing device identity (no second bearer API): the queue lists approved jobs of the bound machine's type; started attaches to a job staff already started, completed/failed reuse the immutable terminal report and the workflow apply path (record_service_cost included), a failure is always held for staff review. The heartbeat takes an optional bounded, clamped, idempotent and rate-limited snapshot. Staff bind a kind to a machine type and read the status list (MANAGE_DEVICES + type scope). The route catalogue already names L11's self-host move route, added with L11 next. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ated restore drills and the optional archive-ready notice (L11) Recording a rotation retires every earlier key of that kind and the builder refuses a retired key; archives still on one are listed, one-space archives are re-encrypted to today's keys (new bytes verified before the row switches) and whole-platform ones can be purged. A drill restores a space's latest archive into a throwaway database with a throwaway identity, reading the live identity in place only, and destroys both. The "archive ready" notice is off by default and carries a signed /control/ link, never the file. /control/ page and host command (backup_keys); hourly drill and re-encryption ticks in both schedulers and the free-tick catalogue. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… in a per-space restore (#77 C#6, L11) Every station is disabled with a fresh public token and its operator leases revoked, so an old station URL or PIN never works after data comes back from a backup; staff re-issue them. The per-space restore does it inside its apply transaction. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…superadmin-run PORTABLE export, target import with staff logins (L11, #128 C-18/C-23, #160) The Space Manager requests with a note and reads the status (no download surface). The superadmin approves and runs the export in /control/ with a one-shot target key plus the platform key; the PORTABLE format carries the credential block, so staff keep their roles active and everyone keeps their sign-in. import_portable_tenant_dump runs the ordinary admission/staging/identity/materialization pipeline and activates the space. Superadmins hear of a request; the space's managers of every status change. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…r the L11 models Key fingerprints, drill reports and move requests are platform state, omitted from exports and tenant dumps; the backup settings gain three platform fields. Completes the barrel lines already committed with L10. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…th the request status (L11, #128 C-23) A note, one button and the request's status in Backup and restore; plain copy on what moves (everything, sign-in included) and that the platform operator runs it. No download. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…erators; SOURCE-MAP INVARIANTS carries the L11 backup section (committed with the L10 docs). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…t a .objects() call the capture-manager guard reads as a default manager Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…tegration routes and the L11 self-host move request Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ack authority (#162(2)) A member route calling rbac.can no longer finds staff actions inside a native member grant or a claim session, and a native staff grant sees only its fixed tenant's. Authentication sets a per-request limit (accounts/session_authority.py, keyed by user id, cleared by NativeSessionContextMiddleware); rbac_memberships._staff_rows applies it, so _membership_for, membership_role, makerspaces_for_action and resolve_scope follow. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…tracks, every alias, no retirement - Generic deletion/purge reads go through backup.capture_managers.every_row (the default membership manager is community-only); discovery widens to every merged shell. - A person holding staff roles may self-delete; the last-manager blocker reads staff-track rows; obligation blockers count every alias; Stage A revokes both tracks. - Stage B processes every id in actor_ids_for: tenant scrubs cover shells (B2's per-space restore re-runs the same scrub), the global step deletes shell leftovers (feeds, endpoints, deliveries, devices, inbox), scrubs merge-record PII and first crypto-shreds the account keys. Audits carry an aliases count. - A tenant purge retires nobody: it sets app.tenant_purge_makerspace_id and deletes the tenant's rows on both tracks; staff_retirement keeps only shell_values. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…and API (#65, #128 C-1) A person links a former staff (converted) account into the signed-in one: - POST auth/account-merge/start (identical answer for unknown identifiers, throttled, login_ip_guard), .../prove (password + authenticator, or two emailed codes digested with login_codes; 10-minute TTL, five attempts, single use, two codes even for one mailbox), .../resend, GET .../preview (roles gained per space, moves per disposition, conflicts, grace), POST .../confirm (recent reauth, staff MFA for elevated survivors, preview_sha256), .../cancel. - Engine: one transaction per pair, lock order Makerspaces -> survivor -> source -> envelopes; revokes source credentials; walks merge_registry (REPOINT / KEEP_ON_SHELL / UNIQUE_RESOLVE with revoked losers); the source becomes a merged-<uuid> shell under the unification GUC; one immutable AccountMergeRecord(merged); the survivor's one 3-day StaffMfaGrace opens when they become staff without a factor. Refuses while any User reference is unclassified. - Audits account.merge_started/merge_proof_failed/merge_cancelled/merged; "accounts linked" platform mail; merge_suggested in the auth payload (Q17); abandoned intents purged by the challenge purge task; merge progress in account_unification_report. - Throttle scopes account_merge_start/account_merge_prove (settings, ENV_SURFACE, env docs). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…n and purge on one account per person, SOURCE-MAP Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…nt-merge routes, merge_suggested) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…n revocation owns its transaction; drill reports name the failing step The self-host move's own audit rows (selfhost_move.*) are coordination history: like tenant_migration.* they are not carried in the PORTABLE archive, so the approving superadmin never enters the space's identity closure. revoke_station_credentials is atomic on its own. A drill failure records the database tool's complaint or the exception class instead of a bare "could not complete". Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…entation guard sees their emitters Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ndations (MachineTypeIntegration, PrinterStatusSnapshot, off-by-default machines.integrations) and backup key rotation, restore drills, station revocation and the self-host move (L10, L11) The lane's OpenAPI regen 3d32bc7 is dropped; staging regenerates it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…napshot and api.ts for L10/L11 (integration routes, self-host move request) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… on custom origins The binding detail route names only the binding, so it had no route target and a verified custom staff origin did not pin it. Its target is now the binding's own makerspace. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…rbac (#162(2)), deletion and purge on one account per person, interactive account merge (U-C) The lane's OpenAPI regen cc92d50 is dropped; staging regenerates it. The presentation catalog barrel keeps L10's, L11's and U-C's fragments. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ging (account-merge routes, merge_suggested); CATALOG unchanged Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Related issue
Type of change
How tested
Checklist
Contributions to Space Works are made under the GNU Affero General Public License,
version 3 or any later version (
AGPL-3.0-or-later).