Server ownership, team access, role-based UI #7

agent · 2026-06-07T06:49:23-04:00

agent commented

2026-06-07 06:49:23 -04:00

Cambios realizados

Base de datos

Nueva migración 002_server_access.sql: columna created_by en servers + tabla server_user

Permisos por servidor (2 niveles)

viewer: puede ver servidores, usar terminal, ver procesos/logs/info
manager: control total sobre el servidor (editar, eliminar, reboot, nginx, ssl, db, etc.)
owner (creador del servidor): control total + gestionar equipo
Super_admin global no tiene bypass — debe estar asignado al servidor

Gestión de equipo

Nueva sección "Team" en sidebar
Página /team con lista de servidores propios
Página /team/:id para agregar/quitar usuarios y cambiar roles (viewer/manager)

UI por roles

Botones destructivos (reboot, shutdown, edit, delete, nginx, ssl, db, services, system users) ocultos para viewers
Badge con el rol del usuario en la página del servidor
Botón "Add Server" y "Add Your First Server" oculto para operators

Default role

Nuevos usuarios se registran como admin (antes operator)
Formulario de admin tiene admin como opción por defecto

## Cambios realizados ### Base de datos - Nueva migración `002_server_access.sql`: columna `created_by` en servers + tabla `server_user` ### Permisos por servidor (2 niveles) - **viewer**: puede ver servidores, usar terminal, ver procesos/logs/info - **manager**: control total sobre el servidor (editar, eliminar, reboot, nginx, ssl, db, etc.) - **owner** (creador del servidor): control total + gestionar equipo - Super_admin global no tiene bypass — debe estar asignado al servidor ### Gestión de equipo - Nueva sección "Team" en sidebar - Página `/team` con lista de servidores propios - Página `/team/:id` para agregar/quitar usuarios y cambiar roles (viewer/manager) ### UI por roles - Botones destructivos (reboot, shutdown, edit, delete, nginx, ssl, db, services, system users) ocultos para viewers - Badge con el rol del usuario en la página del servidor - Botón "Add Server" y "Add Your First Server" oculto para operators ### Default role - Nuevos usuarios se registran como **admin** (antes operator) - Formulario de admin tiene admin como opción por defecto

agent added 1 commit 2026-06-07 06:49:23 -04:00

Add server ownership, team access, role-based UI, and default admin role 5f5de248c6

- New migration 002_server_access.sql: created_by column + server_user table
- Server model: ownership, permission checks, team management methods
- Routes: /team routes, RoleMiddleware on /servers/create and /admin
- ServerController: permission checks via server_user, team CRUD methods
- TerminalController: server access checks
- DashboardController: filter servers by accessible ones
- ApiController: server access checks
- Views: team.php, team_server.php, sidebar Team link, hide actions by role
- Default user role changed from operator to admin on registration
- Admin user form defaults to admin role

agent added 1 commit 2026-06-07 07:08:31 -04:00

Replace old team system with work teams (equipos de trabajo) 5607a3e507

- New migration 003_teams.sql: teams, team_user, team_server tables
- New Team model with CRUD, members, and server assignment
- New TeamController with full team management
- New views: teams/index, teams/create, teams/show
- Server model: getUserRole and getAccessibleServerIds now include team-based access
- Sidebar: Teams link under Administration (admin+ only)
- Routes: old /team routes removed, new /teams routes added
- Removed old ServerController team methods and views
- Fixed sidebar empty accessible IDs returning all servers
- Fixed dashboard and API to show empty when no accessible servers

agent added 1 commit 2026-06-07 07:23:52 -04:00

Filter teams by creator: users only see and manage their own teams e721a34d8f

agent added 1 commit 2026-06-07 07:31:36 -04:00

Fix: wrap entire Administration section in admin+ check to prevent Security leak for operators 58be111745

agent added 1 commit 2026-06-07 07:34:19 -04:00

Restrict Users, Audit Logs, Security routes to super_admin only 016584e907

- Sidebar: Users, Audit Logs and Security now only visible to super_admin
- AdminController: requireSuperAdmin() check on users() and auditLogs()
- AdminController: super_admin check on createUser, updateUser, deleteUser JSON endpoints
- securitySettings() already had the check in place

agent added 1 commit 2026-06-07 07:36:36 -04:00

Refactor sidebar: use is_super_admin/is_admin helpers, restrict Users/Audit/Security to super_admin only 5b13518672

agent added 1 commit 2026-06-07 07:43:39 -04:00

Dashboard stats now scoped to user's accessible servers; super_admin sees all b105b27124

rafaga21 merged commit 2cf30404f4 into master

2026-06-07 07:44:52 -04:00

rafaga21 referenced this issue from a commit

2026-06-07 07:44:52 -04:00

Merge pull request 'Server ownership, team access, role-based UI' (#7) from feature/roles-y-accesos into master

rafaga21 deleted branch feature/roles-y-accesos

2026-06-07 07:44:53 -04:00

Sign in to join this conversation.