mirror of
https://github.com/ipnet-mesh/meshcore-hub.git
synced 2026-07-28 04:22:51 +02:00
Louis King
333b094a77
Replace visibility-tier-based write permissions with ownership-based: operators can only edit/delete routes they created; admins can modify any route and take ownership on edit. Each route stores the creator's OIDC user_id (created_by column). Legacy routes with NULL created_by are admin-only. The creator's friendly name is resolved from UserProfile and displayed on the route card with a profile link. Edit/delete buttons are hidden per-route based on ownership rather than a flat role check. - Migration: add nullable routes.created_by (batch mode, SQLite-safe) - _assert_route_modifiable: dual-check visibility (404) + ownership (403) - create_route: stamps created_by, ensures profile exists - update_route: admin edits transfer ownership (logged) - RouteOwner schema mirrors AdoptedByUser pattern - Batch owner resolution in list endpoint (avoids N+1) - Frontend: per-route canEdit gate, owner badge with profile link - Tests: 20+ backend ownership tests, 5 frontend gating tests, e2e assertions - Docs: routes.md + auth.md updated for ownership model