Add a read-only role per app for calendar, feedback and tickets #21

Merged

Paddy merged 1 commits from feature/readonly-role into master

2026-10-30 20:24:35 +00:00

Author	SHA1	Message	Date
PaddyandClaude Opus 5.5	bfb8f2ff9c	Add a read-only role per app for calendar, feedback and tickets A grant can now be `read` instead of `access`: requireAppAccess lets it through for GET/HEAD/OPTIONS and answers 403 to every other method, so new write routes are covered without being marked. `read` and `access` on the same app are rejected together; user management has no read role. /tickets/admin/me and /feedback/admin/me report `readOnly`. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-29 23:24:28 +01:00

Author

SHA1

Message

Date

PaddyandClaude Opus 5.5

bfb8f2ff9c

Add a read-only role per app for calendar, feedback and tickets

A grant can now be `read` instead of `access`: requireAppAccess lets it
through for GET/HEAD/OPTIONS and answers 403 to every other method, so
new write routes are covered without being marked. `read` and `access`
on the same app are rejected together; user management has no read role.
/tickets/admin/me and /feedback/admin/me report `readOnly`.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-29 23:24:28 +01:00