Permission fixes and redesign after first pentest

- Eliminated user enumeration vector
- Added new permissions to time customer & projects
- Added attachment permissions
- Removed permission set UI as this is not functional at the moment.
Only default role permissions are supported at this time.

Author: Stefan Ernst

frontend/package-lock.json

@@ -48,9 +48,9 @@
     "@github/hotkey": "^3.1.1",
     "@melt-ui/pp": "^0.3.2",
     "@melt-ui/svelte": "^0.86.6",
-    "@milkdown/components": "^7.17.2",
-    "@milkdown/kit": "^7.17.2",
-    "@milkdown/plugin-listener": "^7.17.2",
+    "@milkdown/components": "^7.18.0",
+    "@milkdown/kit": "^7.18.0",
+    "@milkdown/plugin-listener": "^7.18.0",
     "@milkdown/theme-nord": "^7.18.0",
     "@tailwindcss/vite": "^4.1.11",
     "@xyflow/svelte": "^1.3.0",

frontend/package.json

@@ -99,6 +99,11 @@ export const contactRoles = {
 
 // Customer Organisations (requires customers.manage permission)
 export const customerOrganisations = {
-  getAll: () => fetchAPI('/time/customers'),
+  getAll: () => fetchAPI('/customer-organisations'),
+  get: (id) => fetchAPI(`/customer-organisations/${id}`),
+  create: (data) => fetchAPI('/customer-organisations', { method: 'POST', body: JSON.stringify(data) }),
+  update: (id, data) => fetchAPI(`/customer-organisations/${id}`, { method: 'PUT', body: JSON.stringify(data) }),
+  delete: (id) => fetchAPI(`/customer-organisations/${id}`, { method: 'DELETE' }),
   getContacts: (id) => fetchAPI(`/customer-organisations/${id}/contacts`),
+  getProjects: (id) => fetchAPI(`/customer-organisations/${id}/projects`),
 };

frontend/src/lib/api/portal.js

@@ -1,23 +1,6 @@
 import { fetchAPI } from './core.js';
 
 export const time = {
-  customers: {
-    getAll: () => fetchAPI('/time/customers'),
-    get: (id) => fetchAPI(`/time/customers/${id}`),
-    create: (data) => fetchAPI('/time/customers', {
-      method: 'POST',
-      body: JSON.stringify(data),
-    }),
-    update: (id, data) => fetchAPI(`/time/customers/${id}`, {
-      method: 'PUT',
-      body: JSON.stringify(data),
-    }),
-    delete: (id) => fetchAPI(`/time/customers/${id}`, {
-      method: 'DELETE',
-    }),
-    getProjects: (id) => fetchAPI(`/time/customers/${id}/projects`),
-  },
-
   projectCategories: {
     getAll: () => fetchAPI('/time/project-categories'),
     get: (id) => fetchAPI(`/time/project-categories/${id}`),
@@ -54,6 +37,26 @@ export const time = {
       method: 'DELETE',
     }),
     getWorklogs: (id) => fetchAPI(`/time/projects/${id}/worklogs`),
+
+    // Project Managers
+    getManagers: (id) => fetchAPI(`/time/projects/${id}/managers`),
+    addManager: (id, managerType, managerId) => fetchAPI(`/time/projects/${id}/managers`, {
+      method: 'POST',
+      body: JSON.stringify({ manager_type: managerType, manager_id: managerId }),
+    }),
+    removeManager: (id, managerId) => fetchAPI(`/time/projects/${id}/managers/${managerId}`, {
+      method: 'DELETE',
+    }),
+
+    // Project Members
+    getMembers: (id) => fetchAPI(`/time/projects/${id}/members`),
+    addMember: (id, memberType, memberId) => fetchAPI(`/time/projects/${id}/members`, {
+      method: 'POST',
+      body: JSON.stringify({ member_type: memberType, member_id: memberId }),
+    }),
+    removeMember: (id, memberId) => fetchAPI(`/time/projects/${id}/members/${memberId}`, {
+      method: 'DELETE',
+    }),
   },
 
   worklogs: {

frontend/src/lib/api/time.js

@@ -219,15 +219,15 @@
       </div>
 
     </form>
-
-    <DialogFooter
-      onCancel={handleCancel}
-      onConfirm={handleSave}
-      confirmLabel={iteration ? t('sprints.updateIteration') : t('sprints.createIteration')}
-      disabled={saving}
-      loading={saving}
-      showKeyboardHint={true}
-      confirmKeyboardHint={submitHint}
-    />
   </div>
+
+  <DialogFooter
+    onCancel={handleCancel}
+    onConfirm={handleSave}
+    confirmLabel={iteration ? t('sprints.updateIteration') : t('sprints.createIteration')}
+    disabled={saving}
+    loading={saving}
+    showKeyboardHint={true}
+    confirmKeyboardHint={submitHint}
+  />
 </Modal>

frontend/src/lib/dialogs/IterationModal.svelte

@@ -36,7 +36,7 @@
       // Load groups and organisations in parallel
       const [groupsData, orgsData] = await Promise.all([
         api.groups.getAll(),
-        api.time.customers.getAll()
+        api.customerOrganisations.getAll()
       ]);
       groups = groupsData || [];
       organisations = orgsData || [];