logan/server-26
1
0
Fork 0
Code Issues 84 Pull Requests Actions Packages Projects Releases Wiki Activity

Member and node write endpoints are platform-admin-only, blocking org owners #9

New Issue
Open
opened 2026-08-19 22:06:54 -04:00 by logan · 2 comments
logan commented 2026-08-19 22:06:54 -04:00
Owner
Copy Link
Copy Source

Node and system write routes stayed platform-admin-only through the tenancy pass rather than being loosened to org-owner. SAAS_PLAN.md §2.4 implies they should be customer-facing, but that was not one of the twelve build-order items and changing it without its own design pass risked a half-applied permission model.

Consequence: a second, non-admin org owner cannot manage their own nodes or invite members. That blocks onboarding any real customer.

Decide the permission model deliberately — which writes belong to org owners, which stay platform-only — rather than loosening routes one at a time as they are hit.

Node and system *write* routes stayed platform-admin-only through the tenancy pass rather than being loosened to org-owner. `SAAS_PLAN.md` §2.4 implies they should be customer-facing, but that was not one of the twelve build-order items and changing it without its own design pass risked a half-applied permission model. Consequence: a second, non-admin org owner cannot manage their own nodes or invite members. That blocks onboarding any real customer. Decide the permission model deliberately — which writes belong to org owners, which stay platform-only — rather than loosening routes one at a time as they are hit.
logan commented 2026-08-23 17:34:13 -04:00
Author
Owner
Copy Link
Copy Source

Referenced by board minutes #42 (2026-08-23).

Not placed on the revenue gate, deliberately - it is not a security gap (CISO, #39). But the board recorded that it blocks the self-serve model §1/§2 of the now-ratified BUSINESS_MODEL.md depends on: a second real org cannot be onboarded without a platform admin doing it by hand. That is survivable for the Founding Operator cohort (cap 10, high-touch by design) and fatal beyond it.

Per DEFERRED.md, the correct fix needs its own design pass - which write actions belong to "owner", which to "member", and whether node approval should ever be self-serve - not a guess. Sequence that pass before the Founding Operator cohort fills, not after.

**Referenced by board minutes #42 (2026-08-23).** Not placed on the revenue gate, deliberately - it is not a security gap (CISO, #39). But the board recorded that it blocks the self-serve model §1/§2 of the now-ratified `BUSINESS_MODEL.md` depends on: **a second real org cannot be onboarded without a platform admin doing it by hand.** That is survivable for the Founding Operator cohort (cap 10, high-touch by design) and fatal beyond it. Per `DEFERRED.md`, the correct fix needs its own design pass - which write actions belong to "owner", which to "member", and whether node approval should ever be self-serve - not a guess. Sequence that pass before the Founding Operator cohort fills, not after.
logan added the area/auth
priority
p1
type
feature
 labels 2026-10-05 02:04:16 -04:00
logan commented 2026-10-25 21:32:22 -04:00
Author
Owner
Copy Link
Copy Source

UX pass 2026-10-25: user-facing effect still live. Settings tabs Members and Node Ownership are shown to every org owner (app/settings/layout.tsx:14-17) but call admin-only /admin/users (users.py:119-332); owners get a raw 403 (see #286). Organization page member count silently becomes null (settings/organization/page.tsx:39). Until this lands, hide those two tabs for non-admins.

UX pass 2026-10-25: user-facing effect still live. Settings tabs Members and Node Ownership are shown to every org owner (app/settings/layout.tsx:14-17) but call admin-only /admin/users (users.py:119-332); owners get a raw 403 (see #286). Organization page member count silently becomes null (settings/organization/page.tsx:39). Until this lands, hide those two tabs for non-admins.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
area/ai-pipeline
Scene/entity extraction, summarizer, AI providers, embeddings
 area/auth
AuthN/Z, roles, tenancy/org scoping, API keys, credentials
 area/billing
Plans, entitlements, AI spend accounting and caps
 area/correlation
Incident correlation, linking, lifecycle, severity, corr_debug
 area/discord
Discord bot, radio bots, voice streams, bot tokens, webhooks
 area/frontend
Web UI: Next.js app and the edge-node local dashboard
 area/governance
Board process, minutes, unattended runner, agent tooling
 area/growth
Go-to-market, outreach, cold email, discovery conversations
 area/infra-deploy
CI/CD, VM, registry, Firestore rules/indexes deploy, Terraform/Caddy
 area/legal
ToS, retention, licences/DAAs, CAN-SPAM, E&O, name suppression
 area/map
Live map: pins, paths, tiles, legend, geocoding
 area/mqtt
Node-C2 MQTT, checkins, commands, node sweeper, dynsec
 area/node-ota
Node install, enrollment, OTA updater, image skew
 area/osint
External feeds: cameras, 511, ADS-B, AIS, outages, and their licences
 area/recording-audio
Call capture, boundaries, PulseAudio, ring buffer, trimming, attribution
 area/sdr-radio
OP25 decode, SDR hardware/tuning, conventional, second SDR, mesh radio
 area/transcription
STT, transcript correction, place verification, name accuracy
 board
Board process: minutes and board-filed items
 board:agenda
Needs board scoping at the next sitting; CEO removes the label once scoped
 minutes:draft
One exec pre-read, closed by CEO
 minutes:final
CEO ruling; open until enacted
 role:ceo
Filed by the CEO
 role:cfo
Filed by the CFO
 role:cio
Filed by the CIO
 role:ciso
Filed by the CISO
 role:cmo
Filed by the CMO
 role:coo
Filed by the COO
 role:cto
Filed by the CTO
kind
behavior-bug
Wrong product behavior; the instrument reads it correctly
kind
measurement-bug
Corrupts the recording/instrument (debug data, evals, health checks), not behavior
priority
p0
Drop everything: prod broken, live exposure, or owner-ruled P0
priority
p1
Next up: blocks a gate, a customer, or core incident quality
priority
p2
Normal: real defect or planned work, schedule in turn
priority
p3
Low: minor, cosmetic, or someday
status
blocked
Waiting on an external party, spend, or another issue
status
in-progress
Branch or PR open against it
status
needs-decision
Waiting on an owner or board ruling before work
status
needs-info
Root cause or repro unknown; needs a reading first
type
bug
Something built is wrong: code, data, or a measurement
type
chore
Maintenance, refactor, tests, pinning, cleanup: no user-visible change
type
decision
A ruling to make or record: board minutes, owner calls, legal reviews
type
docs
Docs, runbooks, CLAUDE.md, skills, SOPs
type
feature
New capability or an extension of an existing one
type
security
Security, privacy, credential or tenant-isolation exposure
type
tracking
Tracker, checklist, initiative or punch-list spanning several changes
No labels area/auth
priority
p1
type
feature
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
logan
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: logan/server-26#9