cproudlock d6a78a72ff printedparts stage 6: RBAC - declared permissions gate every mutation ...

get_permissions declares view/create/edit/delete/restock (seeded on
install/enable and by flask seed permissions); every write route adds
require_permission on top of jwt_required. New test proves
authentication alone is not authorization: a role-less member gets
403 where an admin succeeds.

2026-07-17 07:42:07 -04:00

3.3 KiB

Raw Blame History

View Raw