v0.6.10: scope admins like regular users (#177) #197

Merged

Cordy merged 2 commits from ship-v0.6.10 into main

2026-08-11 22:38:40 +00:00

Cordy commented

2026-08-11 22:37:02 +00:00

Owner

#177 — admins are scoped exactly like regular users

Per the decision on #177 (the strict model): removes the admin exemption in internal/storage/scope/scope.go resolve(). Admins now get the same /home + /spaces overlay as everyone else — Personal is the admin's own home, Spaces are the admin's own groups — and there is no in-UI path to another user's home or a non-member space. Cross-user access is out-of-band only (storage backend + the deployment recovery key).

Diff

scope.go: delete the if d.admins[...] || u.Admin { return unscoped } block in resolve(); update the package/New docs; mark the admins field vestigial (kept to avoid churning ~13 call sites; a follow-up removes the plumbing).
scope_test.go: replace TestAdminUnscoped with TestAdminScoped — asserts a backend-root path is ErrNotFound, a /home/<other> path maps into the admin's OWN home (/home/root/alice/...), and the auth.User.Admin flag confers no access to a non-member space.
CHANGELOG.

Why it's safe / what's unaffected

Server-side only — the UI just renders what the API returns, so no frontend change.
go test ./... is green across every package: nothing else relied on admin-unscoped file access via the scope driver.
Admin panels unaffected (settings, holds, audit, peering, all-shares) — they're gated by requireAdmin, not scope.
Legal holds still work — holds.go records the typed backend path directly (not scope-resolved); enforcement is at the backend layer.
Share serving / peering unaffected — they use the unscoped store server-side, never the admin's scoped view.

Consequences (accepted per #177, tracked)

No cross-home move / space-repair via the UI (was unscoped).
The holds/Move folder picker (#185) can only browse the admin's own tree; typed backend paths remain for holds on others' data.
The admin all-shares view still shows backend paths (display; folded into the #177/#192 follow-up).

Closes #177.

## #177 — admins are scoped exactly like regular users Per the decision on #177 (the strict model): removes the admin exemption in `internal/storage/scope/scope.go` `resolve()`. Admins now get the same `/home` + `/spaces` overlay as everyone else — Personal is the admin's own home, Spaces are the admin's own groups — and there is **no in-UI path** to another user's home or a non-member space. Cross-user access is out-of-band only (storage backend + the deployment recovery key). ### Diff - `scope.go`: delete the `if d.admins[...] || u.Admin { return unscoped }` block in `resolve()`; update the package/`New` docs; mark the `admins` field vestigial (kept to avoid churning ~13 call sites; a follow-up removes the plumbing). - `scope_test.go`: replace `TestAdminUnscoped` with **`TestAdminScoped`** — asserts a backend-root path is `ErrNotFound`, a `/home/<other>` path maps into the admin's OWN home (`/home/root/alice/...`), and the `auth.User.Admin` flag confers no access to a non-member space. - CHANGELOG. ### Why it's safe / what's unaffected - **Server-side only** — the UI just renders what the API returns, so no frontend change. - **`go test ./...` is green** across every package: nothing else relied on admin-unscoped file access via the scope driver. - **Admin panels unaffected** (settings, holds, audit, peering, all-shares) — they're gated by `requireAdmin`, not scope. - **Legal holds still work** — `holds.go` records the typed backend path directly (not scope-resolved); enforcement is at the backend layer. - **Share serving / peering unaffected** — they use the unscoped store server-side, never the admin's scoped view. ### Consequences (accepted per #177, tracked) - No cross-home move / space-repair via the UI (was unscoped). - The holds/Move folder picker (#185) can only browse the admin's own tree; typed backend paths remain for holds on others' data. - The admin all-shares view still shows backend paths (display; folded into the #177/#192 follow-up). Closes #177.

Cordy added 2 commits

2026-08-11 22:37:03 +00:00