Cheng Zhou
57 lines
2.3 KiB
Markdown
57 lines
2.3 KiB
Markdown
# Project Permission Consistency Implementation Plan
|
|
|
|
> **For Claude:** REQUIRED SUB-SKILL: Use superpowers:executing-plans to implement this plan task-by-task.
|
|
|
|
**Goal:** Make project-level backend permissions and frontend route/menu/action visibility consistent.
|
|
|
|
**Architecture:** Treat backend `API_ENDPOINT_PERMISSIONS` and effective `/api-permissions/me` matrix as the source of truth. Frontend route guards, menus, quick actions, page actions, and attachment controls should only project that matrix into visibility or disabled states.
|
|
|
|
**Tech Stack:** FastAPI, SQLAlchemy, pytest, Vue 3, Pinia, Vue Router, Element Plus, Vitest.
|
|
|
|
---
|
|
|
|
### Task 1: Frontend Action Visibility
|
|
|
|
**Files:**
|
|
- Modify: `frontend/src/components/QuickActions.vue`
|
|
- Modify: `frontend/src/views/ia/SubjectManagement.vue`
|
|
- Modify: `frontend/src/utils/permission.ts`
|
|
- Test: `frontend/src/views/ia/SubjectManagement.test.ts`
|
|
- Test: `frontend/src/utils/permission.test.ts`
|
|
|
|
**Steps:**
|
|
1. Write failing source-level tests that prove quick actions are filtered by `getProjectRoutePermission`/`hasProjectPermission`.
|
|
2. Write failing source-level tests that prove subject create/delete actions are guarded by `subjects:create` and `subjects:delete`.
|
|
3. Add minimal permission checks in the affected components.
|
|
4. Run the targeted Vitest files and confirm they pass.
|
|
|
|
### Task 2: Permission Contract Coverage
|
|
|
|
**Files:**
|
|
- Modify: `frontend/src/utils/projectRoutePermissions.test.ts`
|
|
- Modify: `backend/tests/test_api_permissions.py`
|
|
|
|
**Steps:**
|
|
1. Add tests for route landing paths and project route mappings using backend operation key names already present in the frontend contract.
|
|
2. Extend backend configuration tests so service-level checks are included where feasible, especially document and attachment permission mappings.
|
|
3. Keep tests focused on permission contract shape, not business data setup.
|
|
4. Run targeted backend pytest files.
|
|
|
|
### Task 3: Verification
|
|
|
|
**Files:**
|
|
- No production files unless tests identify another mismatch.
|
|
|
|
**Steps:**
|
|
1. Run targeted frontend tests.
|
|
2. Run frontend type check if dependencies are available.
|
|
3. Run targeted backend permission tests.
|
|
4. Report exact commands and results.
|
|
|
|
### Constraints
|
|
|
|
- Do not create branches.
|
|
- Do not commit.
|
|
- Do not revert unrelated dirty worktree changes.
|
|
- Keep changes narrow and avoid redesigning permission management.
|