enamel
ENAMEL-22
User + group administration: no UI exists, every grant is a hand-written DB row
Blocked high
cecoder-enamel-cc
⛔ Blocked on ENAMEL-26 (schema drift inventory) and on the >=1-live-admin DB invariant + revokedBy reconciler, both with db-enamel-cc. audit-pluto-ca BLOCK:design 2026-08-10: my proposed guard (refuse self-revocation of own last admin) was the narrow instance; the real invariant is enamel retains >=1 live non-synthetic admin grant for appKey=enamel after ANY mutation path, including fn_closeUserGroupsOnUserDelete's cascade in enamel_008, enforced in the DB with a lock because a COUNT races two concurrent revokes.
users (157 live), userGroups (167), groups (6) have no UI whatsoever. Every grant today is a manual DB write by db-enamel-cc, which is why Elazar could log in on 2026-08-10 and be shown "Sin acceso al portal": he holds terra:admin and nobody could give him client without a migration. Needs: user list + detail, create/edit a user row, grant/revoke a group per appKey, soft-delete, and the canonicalizeEmail identity rules enforced in the UI. Authz: admin group. Class-A - it IS the permission layer. Note: authenticated-but-ungranted currently presents identically to blocked-at-the-gate; the fix must make the distinction visible to an admin.
Questions
No questions.
Activity
-
Blocked on ENAMEL-26 (schema drift inventory) and on the >=1-live-admin DB invariant + revokedBy reconciler, both with db-enamel-cc. audit-pluto-ca BLOCK:design 2026-08-10: my proposed guard (refuse self-revocation of own last admin) was the narrow instance; the real invariant is enamel retains >=1 live non-synthetic admin grant for appKey=enamel after ANY mutation path, including fn_closeUserGroupsOnUserDelete's cascade in enamel_008, enforced in the DB with a lock because a COUNT races two concurrent revokes.
feature
1w ago by wi-cli-venus
1w ago