174c6c0b9a
The lobby-display and screensaver slide manager was admin-only. Add a shared slides.manage permission so a curator can manage both surfaces without full admin. Admins keep access via the require_permission admin bypass. Backend: - plugins/slides/api/routes.py: all 5 management routes require slides.manage - plugins/slides/plugin.py: declare it via get_permissions(); nav item carries the permission so the frontend can gate visibility - shopdb/core/api/auth.py: login response now returns the user's permissions (matches /me) so the frontend authStore has them on fresh login Frontend: - stores/auth.js: hasPermission(name) getter (admin true, else granted list) - router/index.js: guard supports requiresPermission - views/AppLayout.vue: hide nav items whose permission the user lacks - plugins/slides/frontend/routes.js: slide manager gated requiresPermission Tests: no-perm user 403, curator role with the perm 200 (+ login advertises it), admin 200 via bypass. Deploy: run `flask seed permissions` to create the row, then grant it to a role in Settings > Users & Roles.
25 lines
573 B
JavaScript
25 lines
573 B
JavaScript
|
|
export default [
|
|
{
|
|
path: 'settings/slides',
|
|
name: 'slide-manager',
|
|
component: () => import('./views/SlideManager.vue'),
|
|
meta: { requiresAuth: true, requiresPermission: 'slides.manage', plugin: 'slides' }
|
|
}
|
|
]
|
|
|
|
export const toplevel = [
|
|
{
|
|
path: '/tv',
|
|
name: 'tv',
|
|
component: () => import('./views/TVDashboard.vue'),
|
|
meta: { plugin: 'slides', surface: 'lobby' }
|
|
},
|
|
{
|
|
path: '/screensaver',
|
|
name: 'screensaver',
|
|
component: () => import('./views/TVDashboard.vue'),
|
|
meta: { plugin: 'slides', surface: 'shopfloor' }
|
|
}
|
|
]
|