Badges · Permissions

0 modules · 0 exports · 1 repository · 1 e2e test · 3 routes

OverviewRepositoriesPermissionsE2E tests

Who may do what in Badges: the per-object permissions it builds with every place checking them, and the checks in its code. See Permissions for how authorization works and the reference for every role and feature.

Granted here

Built at read time into what the functions return, a list of the user ids holding each permission. Checks are listed wherever they are, other features' included.

Permission	Granted by	Checked in
MANAGE	addPermissions row.managers.map((m) => m.userId)	Serverbadges.$id.edit.server.ts Clientbadges.$id.edit.tsxbadges.$id.tsx read directly badges.tsx

Global roles

The global roles this feature's code checks, see who has each.

Role	Checked in
STAFF	Serverbadges.$id.edit.server.ts Clientbadges.$id.edit.tsxbadges.$id.tsx

Outside the system

Reading x.permissions.NAME directly skips hasPermission and with it the admin bypass, and authorizing an action on an object with isAdmin and friends is a bug. Some of these are deliberate, the permissions doc lists the boundaries.

• read directly in app/features/badges/routes/badges.tsx:126 if (user && badge.permissions.MANAGE.includes(user.id)) {