mirror of
https://github.com/DarkflameUniverse/DarkflameServer.git
synced 2026-10-20 11:42:49 +00:00
821b7c8767
What someone may do on the dashboard is now their GM level's permissions plus the grants on their account, minus its denies (PermissionGrants.h). A deny beats a grant; denies never apply to GM 9, and settings and permissions_manage stay GM 9 only. The account's grants are read with every request (like its GM level), so a change applies at once, and they are passed through every check: RouteUtils::Can, CanViewCharacter, the rank rules (self_* and manage_equal_rank), routes guarded by a permission, the templates' `can`, the API documentation, API access, API key scopes (a key never does more than its owner may now) and WebSocket subscriptions. New permission grants_manage (GM 9 by default) and the API to manage grants: GET /api/grants/catalog, GET /api/grants, POST /api/grants, POST /api/grants/:id/remove. Nobody grants or takes away what they don't hold themselves (a permission, every permission of a group, a command they may use, every command up to their own GM level), and only on accounts the rank rules let them manage (their own with self_moderation). Commands with a fixed level or a floor above GM 1 (/execute) can't be granted. Every change goes in the audit log (grant_permission, deny_permission, remove_grant). Also: the Showcase gate and the traffic subscription now check their permission by name. Check: grant a GM 2 account accounts_ban (it can ban, and the Ban button shows); deny a GM 8 account accounts_view (the accounts list is refused); give an expiry a minute ahead and see it stop; try to grant a permission your account doesn't have (refused); dWebTests PermissionGrantsTests. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
105 lines
2.9 KiB
CMake
105 lines
2.9 KiB
CMake
set(DASHBOARDROUTES_SOURCES
|
|
"APIRoutes.cpp"
|
|
"StaticRoutes.cpp"
|
|
"DashboardRoutes.cpp"
|
|
"WSRoutes.cpp"
|
|
"AuthRoutes.cpp"
|
|
"ApiKeyRoutes.cpp"
|
|
"GrantRoutes.cpp"
|
|
"RouteUtils.cpp"
|
|
"PlayerActions.cpp"
|
|
"AccountRoutes.cpp"
|
|
"ClientAssets.cpp"
|
|
"MaintenanceRoutes.cpp"
|
|
"ReportRoutes.cpp"
|
|
"EconomyPlaces.cpp"
|
|
"SecurityRoutes.cpp"
|
|
"WebhookRoutes.cpp"
|
|
"EconomyJobs.cpp"
|
|
"LiveWorld.cpp"
|
|
"LiveUpdateRoutes.cpp"
|
|
"SettingsRoutes.cpp"
|
|
"Background.cpp"
|
|
"Scheduler.cpp"
|
|
"SettingsCatalog.cpp"
|
|
"BackupRoutes.cpp"
|
|
"BackupFiles.cpp"
|
|
"ReportViews.cpp"
|
|
"CharacterTools.cpp"
|
|
"CharacterRestore.cpp"
|
|
"MissionTools.cpp"
|
|
"CharacterProgress.cpp"
|
|
"ServerRoutes.cpp"
|
|
"LogBundle.cpp"
|
|
"Traffic.cpp"
|
|
"TrafficHistory.cpp"
|
|
"LeaderboardRoutes.cpp"
|
|
"VanityRoutes.cpp"
|
|
"ChatRoutes.cpp"
|
|
"Strikes.cpp"
|
|
"Inspector.cpp"
|
|
"CDClientBrowser.cpp"
|
|
"SettingsHistory.cpp"
|
|
"Announcements.cpp"
|
|
"EventsCalendar.cpp"
|
|
"LiveEventRoutes.cpp"
|
|
"ChallengeRoutes.cpp"
|
|
"InstanceLoad.cpp"
|
|
"WorldView.cpp"
|
|
"Scenery.cpp"
|
|
"WorkerPool.cpp"
|
|
"Workers.cpp"
|
|
"AccountModeration.cpp"
|
|
"ModerationTools.cpp"
|
|
"ModeratorHelper.cpp"
|
|
"../ai/ClaudeClient.cpp"
|
|
"../ai/ModeratorPrompt.cpp"
|
|
"PublicRoutes.cpp"
|
|
"Showcase.cpp"
|
|
"FeaturedProperties.cpp"
|
|
"ContrabandRoutes.cpp"
|
|
"UgcRoutes.cpp"
|
|
"UgcLinks.cpp"
|
|
"UgcFetch.cpp"
|
|
"PropertyRentRoutes.cpp"
|
|
"PasswordRecovery.cpp"
|
|
"PrometheusMetrics.cpp"
|
|
"../email/SmtpClient.cpp"
|
|
"../email/EmailService.cpp"
|
|
"../email/OAuth2.cpp"
|
|
"../notify/WebhookFormat.cpp"
|
|
"../notify/Alerts.cpp"
|
|
# Shared with the world servers, which add items and models the same way
|
|
"${PROJECT_SOURCE_DIR}/dGame/dUtilities/ObjectIDManager.cpp"
|
|
)
|
|
|
|
add_library(DashboardRoutes STATIC ${DASHBOARDROUTES_SOURCES})
|
|
|
|
target_include_directories(DashboardRoutes PRIVATE
|
|
"${PROJECT_SOURCE_DIR}/dCommon"
|
|
"${PROJECT_SOURCE_DIR}/dCommon/dClient"
|
|
"${PROJECT_SOURCE_DIR}/dCommon/dEnums"
|
|
"${PROJECT_SOURCE_DIR}/dDatabase"
|
|
"${PROJECT_SOURCE_DIR}/dDatabase/CDClientDatabase"
|
|
"${PROJECT_SOURCE_DIR}/dDatabase/CDClientDatabase/CDClientTables"
|
|
"${PROJECT_SOURCE_DIR}/dDatabase/GameDatabase"
|
|
"${PROJECT_SOURCE_DIR}/dDatabase/GameDatabase/ITables"
|
|
"${PROJECT_SOURCE_DIR}/dDatabase/GameDatabase/MySQL"
|
|
"${PROJECT_SOURCE_DIR}/dNet"
|
|
"${PROJECT_SOURCE_DIR}/dWeb"
|
|
"${PROJECT_SOURCE_DIR}/dServer"
|
|
"${PROJECT_SOURCE_DIR}/thirdparty"
|
|
"${PROJECT_SOURCE_DIR}/thirdparty/nlohmann"
|
|
"${PROJECT_SOURCE_DIR}/thirdparty/libbcrypt/include"
|
|
"${PROJECT_SOURCE_DIR}/dDashboardServer/auth"
|
|
"${PROJECT_SOURCE_DIR}/dDashboardServer/routes"
|
|
"${PROJECT_SOURCE_DIR}/dDashboardServer/email"
|
|
"${PROJECT_SOURCE_DIR}/dDashboardServer/notify"
|
|
"${PROJECT_SOURCE_DIR}/dDashboardServer/ai"
|
|
"${PROJECT_SOURCE_DIR}/dChatFilter" # word rules for the chat filter page
|
|
"${PROJECT_SOURCE_DIR}/dGame/dUtilities" # ObjectIDManager.h
|
|
)
|
|
|
|
target_compile_definitions(DashboardRoutes PRIVATE PROJECT_VERSION="\"${PROJECT_VERSION}\"")
|
|
target_link_libraries(DashboardRoutes PRIVATE ${COMMON_LIBRARIES} dWeb dServer dUgc sqlite3 OpenSSL::Crypto CURL::libcurl)
|