diff --git a/CHANGELOG.md b/CHANGELOG.md index 1a9425fd..8b9670d8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -12,6 +12,46 @@ ADR-007 and ADR-002. ### Added +- **A guide's sections can be ticked off while you read it.** Only checklist + items were tickable, which answered "what have I done" but not the question a + long procedure actually raises - where was I. Somebody looks away to do the + thing the guide asked for and looks back at a wall of text. Every step and + every heading now carries a checkbox in the reader; ticking one strikes it + through and fades it rather than hiding it, because scanning back up the page + has to still show what was done. Headings count as well as steps: a guide + converted from an HTML article often has fifty headings and no steps at all. + Progress is per browser and per version, as it already was for checklists - + shopfloor PCs share a login, so one technician's ticks must not greet the + next person on that bay. + +- **A guest is a role now, not a switch per feature.** Whether somebody with no + account may see something was answered one feature at a time: a + `securesend_allow_guests` setting, an enable flag per kiosk, and very nearly a + third for guides - each with its own settings page and its own hand-written + branch inside a route. It is a permissions question, and this app already + administers permissions per role, so anyone not signed in now holds the + seeded `guest` role. It starts with nothing, so an upgrade opens no door; a + site opens one by ticking a box in the same role grid it uses for everybody + else, and closes it the same way - taking effect on the next request, not the + next restart. `require_permission` consults the role when there is no token, + which is the whole mechanism. + + What a guest may be granted is bounded: any `.view` or `.read` permission, + plus writes a plugin has explicitly declared safe to perform without an + account (`get_guest_grantable_permissions`, contract 0.21.0). Secure Send + declares its create permission, because sending a password to a vendor is the + one write the product means to offer somebody who never signs in. Everything + else is refused by the API and greyed out in the grid rather than warned + about. A guest write records no creator - the audit trail can say when and + from where, never who - and that is the reason for the bar. + + GE-Enforce and Slides gained read permissions (`geenforce.view`, + `slides.view`) so they can be opened to guests without handing out the manage + right; their read routes accept either, so nothing an existing manager could + reach has moved. The navigation endpoint now returns only what the caller can + actually reach, so a signed-out visitor sees the pages that were opened to + them rather than a sidebar of links that bounce off a login page. + - **USB check-in / check-out audit report.** CMMC removable-media tracking is an audit obligation and there was no report for it - answering "who had this drive, and when" meant paging through the check-in/out list by hand. The diff --git a/frontend/src/views/AppLayout.vue b/frontend/src/views/AppLayout.vue index 2d37253a..8ea01593 100644 --- a/frontend/src/views/AppLayout.vue +++ b/frontend/src/views/AppLayout.vue @@ -11,7 +11,9 @@ -
+ +
slides.manage); hide it from anyone who lacks it so the // link does not dead-end at the router guard. Admins hold every permission. - const visible = items.filter(item => - !item.permission || authStore.hasPermission(item.permission)) + // + // A signed-out visitor sees only what a plugin has declared guest-reachable. + // Without this the sidebar offers a signed-out reader the whole app and every + // link bounces them to the login page, which reads as a broken site rather + // than as a closed door. + // A nav item may name one permission or several; holding ANY of them is + // enough. GE-Enforce and Slides need that: the page is reachable by a + // manager and by a plain viewer, and they hold different strings. + const holds = item => { + if (!item.permission) return true + const names = Array.isArray(item.permission) ? item.permission : [item.permission] + return names.some(name => authStore.hasPermission(name)) + } + // A signed-out visitor gets whatever the server sent, which is already + // filtered to what the guest role can reach - hasPermission knows nothing + // about guests, so asking it here would hide everything. + const visible = authStore.isAuthenticated ? items.filter(holds) : items const known = new Set(NAV_SECTIONS.map(s => s.key).filter(Boolean)) const bucket = item => { diff --git a/frontend/src/views/settings/UsersList.vue b/frontend/src/views/settings/UsersList.vue index 58fd9aaf..242506da 100644 --- a/frontend/src/views/settings/UsersList.vue +++ b/frontend/src/views/settings/UsersList.vue @@ -225,6 +225,17 @@

Select which actions this role can perform

+ +

+ This role is everyone who is not signed in. + Anything ticked here is readable by anybody who can reach this + site, with no account and no name in the audit log. Greyed-out + permissions cannot be given to guests at all. +

@@ -239,10 +250,14 @@
-