LeoVasanko/paskia
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Better handling of Org Admin permission. More guardrails for Master Admin not locking himself out by changes. Admin app UI improvements.

Browse Source
This commit is contained in:
Leo Vasanko
2026-01-23 15:11:01 +00:00
parent 253387be97
commit 4c1db37c73
8 changed files with 234 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files
paskia/bootstrap.py
+9 -4
View File
@@ -66,20 +66,25 @@ async def bootstrap_system() -> dict:
)
db.create_permission(perm0)
# Create org admin permission - allows managing users within an org
perm_org_admin = Permission(
uuid=uuid7.create(), scope="auth:org:admin", display_name="Org Admin"
)
db.create_permission(perm_org_admin)
org = Org(uuid7.create(), "Organization")
db.create_organization(org)
# After creation, org.permissions now includes the auto-created org admin permission (auth:org:admin)
# Allow this org to grant global admin explicitly
# Allow this org to grant global admin and org admin permissions
db.add_permission_to_organization(str(org.uuid), perm0.scope)
db.add_permission_to_organization(str(org.uuid), perm_org_admin.scope)
# Create an Administration role granting both org and global admin
# Compose permissions for Administration role: global admin + org admin auto-perm
role = Role(
uuid7.create(),
org.uuid,
"Administration",
permissions=[perm0.scope, *org.permissions],
permissions=[perm0.scope, perm_org_admin.scope],
)
db.create_role(role)