gitlawrandjialin
2889ba7c78
Four purely-additive seams that let build-time tooling extend host behaviour without forking files: * `src/access.extensions.ts` — identity `applyAccessExtensions` (mirrors `config/routes.extensions.ts`). `src/access.ts` runs the resolved predicate object through it. Adds two new predicates, `canSeeOrgAdmin` and `canManageCurrentOrg`, alongside the existing `canSeeAdmin`. Resources, Models children, Cluster Management, and Resources/Backends are retagged from `canSeeAdmin` to `canSeeOrgAdmin`. Users and Dashboard stay strict. * `src/request.extensions.ts` — identity-empty `extraRequestInterceptors`. `src/request-config.tsx` spreads it into the existing `requestInterceptors` list so extensions can inject context-aware headers without forking the request config. * Users page action column — renders `getGPUStackPlugin()?.components?.UserRowActions` next to the existing DropdownButtons inside a Space when a plugin component is registered. If absent, the cell renders exactly as before. * `src/components/plugin-extra-fields.tsx` — generic component-slot helper. Renders `pluginManager.components.<name>` if registered, forwarding a `context` payload. Used by create/edit forms to let plugins inject extra `Form.Item` fields. Mounted in the relevant create forms — API Keys, Cloud Credentials, Clusters, Model Routes, Model Providers, and Inference Backends — under the slot name `CreateOrgScopeField`. Resources whose org is implicit from a parent (Models / Workers / Benchmarks / Worker Pools / Model Files inherit from the chosen Cluster) deliberately don't mount the slot.
36 lines
1.3 KiB
TypeScript
36 lines
1.3 KiB
TypeScript
import { applyAccessExtensions } from './access.extensions';
|
|
|
|
export default (initialState: { currentUser?: Global.UserInfo }) => {
|
|
const isPlatformAdmin = !!(
|
|
initialState &&
|
|
initialState.currentUser &&
|
|
initialState.currentUser.is_admin
|
|
);
|
|
const canSeeUser = !!(
|
|
initialState &&
|
|
initialState.currentUser &&
|
|
!initialState.currentUser.is_admin
|
|
);
|
|
|
|
// Predicate roles, top-down by strictness:
|
|
// * `canSeeAdmin` — strictly platform admin (`users.is_admin`).
|
|
// Gates Users, Dashboard.
|
|
// * `canSeeOrgAdmin` — admin-style menus that work cross-org
|
|
// (Resources, Models, Cluster Management). Defaults to platform
|
|
// admin; extensions widen to include org admins.
|
|
// * `canManageCurrentOrg` — pages that only make sense inside a
|
|
// specific org context (member / group management). Defaults to
|
|
// `false`; extensions widen when both an org is selected AND
|
|
// the caller is admin of it.
|
|
// Pass through `applyAccessExtensions` so build-time tooling can
|
|
// widen these without editing this file. Default is a no-op.
|
|
return applyAccessExtensions({
|
|
canSeeAdmin: isPlatformAdmin,
|
|
canSeeOrgAdmin: isPlatformAdmin,
|
|
canManageCurrentOrg: false,
|
|
canSeeUser,
|
|
canDelete: true,
|
|
canLogin: true
|
|
});
|
|
};
|