web permissions2

web/CHANGELOG.md

@@ -16,7 +16,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ### Added
 
-- **Role, user and permission administration** — `/admin/permissions` consumes
+- **Role, user and permission administration** — `/permissions` consumes
   `ListRoles`, `AddRole`, `RemoveRole`, `ListUsers`, `AssignUserRole`,
   `ListRolePermissions`, `ListGrantableObjects`, `GrantPermission` and
   `RevokePermission`. Direct and inherited grants are distinguished, and the
@@ -37,6 +37,20 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ### Changed
 
+- **Permissions moved out of the admin panel into their own nav section, split
+  in three** — `/admin/permissions` is gone; the pages are `/permissions/roles`
+  (which roles exist), `/permissions/users` (who holds them) and
+  `/permissions/grants` (what a role may do). No new gRPC endpoint is consumed:
+  the same `GrantPermission` and `RevokePermission` calls now come from one
+  `POST /permissions/grants/apply`, which issues one call per `object|action`
+  pair so a shortcut — a whole row, a whole profile, everything — is a longer
+  list rather than a different request. Shortcuts grant the wildcard objects
+  `ListGrantableObjects` already returns (`data:*`, `data:<profile>/*`,
+  `journal:*`, `ecb:*`), so they keep covering profiles and tables created
+  later, and `AddRole` may be followed by a starter set of those grants in the
+  same submission. Revoking tolerates the `NOT_FOUND` a pair the role does not
+  hold directly answers with, which is what makes "remove all of this"
+  idempotent.
 - **Web authorization follows permission objects, not role names** — structural
   pages check their `struct:<area>/manage` permission from `GetAuthorization`,
   so inherited `superadmin` authorization works and data roles are no longer