nils/papercrate
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

readonly role

Browse Source
This commit is contained in:
nils
2025-11-05 14:10:57 +01:00
parent 480bc20ae7
commit a75281aa13
8 changed files with 91 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/api.txt
+3 -2
View File
@@ -25,7 +25,8 @@ Documents
- POST /api/documents/bulk/reanalyze - Queue re-analysis jobs for selected documents.
- GET /api/documents/:id - Retrieve metadata and current version details for a document.
- PATCH /api/documents/:id - Update document metadata (currently title).
- DELETE /api/documents/:id - Soft-delete a document.
- POST /api/documents/:id/trash - Move a document to trash (soft delete, reversible).
- DELETE /api/documents/:id - Permanently erase a trashed document. Returns 202 Accepted, queues a purge job, and fails with 409 if the document is still active.
- PATCH /api/documents/:id/folder - Move a document to another folder.
- POST /api/documents/:id/restore - Restore a soft-deleted document. Optional body `{ "folder_id": <uuid> }` to send it to a specific folder; defaults to the original folder or root if missing.
- GET /api/documents/:id/versions - List version history for a document.
@@ -67,4 +68,4 @@ Correspondents
- GET /api/correspondents - List correspondents with usage totals.
- POST /api/correspondents - Create a correspondent (name + optional metadata JSON).
- PATCH /api/correspondents/:id - Update name and/or metadata.
- DELETE /api/correspondents/:id - Remove a correspondent; fails with 400 if referenced by any document.
- DELETE /api/correspondents/:id - Remove a correspondent; fails with 400 if referenced by any document.
docs/capability_sets.md
+2 -1
View File
@@ -28,10 +28,11 @@ All capabilities live in the `ApiCapability` enum. The current list is:
## Default Sets
Provisioning (and the test harness) seed three system capability sets per tenant:
Provisioning (and the test harness) seed four system capability sets per tenant:
- `owner` — contains the full set above. Tenant owners, admin users, and freshly minted API tokens effectively get unrestricted access.
- `user` — the default interactive role: full document/tag/correspondent/profile access, but no capability-set or WebDAV write privileges.
- `readonly` — interactive but read-only: document/folder/tag/correspondent reads plus WebDAV downloads, but no modifying routes.
- `webdav` — contains only `webdav:read`. WebDAV backup scripts can bind to this set for read-only access.
System sets are flagged with `is_system = true` and cannot be modified or deleted via the API.