You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The authorization system internals have been refactored, but the admin REST API response shapes are preserved. All endpoints use the same URL paths, HTTP methods, request bodies, and response JSON shapes as before.
4
+
5
+
Request bodies use integer enum values for `type` and `relation` fields (e.g., `"type": 5` for user, `"relation": 1` for admin), matching the previous proto3 JSON format.
6
+
7
+
## Unchanged endpoints
8
+
9
+
All endpoints retain their existing response shapes:
10
+
11
+
| Endpoint | Description |
12
+
|----------|-------------|
13
+
|`GET /me`| Current user info |
14
+
|`GET /tenants`| List tenants |
15
+
|`GET /tenants/:id`| Tenant permissions |
16
+
|`POST /tenants/:id`| Update tenant name |
17
+
|`POST /tenants/:id/groups`| Create group under tenant |
18
+
|`POST /tenants/:id/permissions`| Add permission to tenant |
19
+
|`DELETE /tenants/:id/permissions`| Remove permission from tenant |
20
+
|`GET /groups`| List groups |
21
+
|`GET /groups/:id`| Group permissions |
22
+
|`POST /groups/:id`| Update group name |
23
+
|`POST /groups/:id/permissions`| Add permission to group |
24
+
|`DELETE /groups/:id/permissions`| Remove permission from group |
25
+
|`POST /groups/:id/tenant`| Set group's parent tenant |
26
+
|`GET /feeds`| List feeds |
27
+
|`GET /feeds/:id`| Feed permissions |
28
+
|`POST /feeds/:id/group`| Set feed's parent group |
29
+
|`GET /feed_versions`| List feed versions |
30
+
|`GET /feed_versions/:id`| Feed version permissions |
31
+
|`POST /feed_versions/:id/permissions`| Add permission to feed version |
32
+
|`DELETE /feed_versions/:id/permissions`| Remove permission from feed version |
33
+
|`GET /users`| List users |
34
+
|`GET /users/:id`| Get user |
35
+
36
+
## Minor behavioral changes
37
+
38
+
-**Actions map**: Only granted permissions (`true`) are included in the `actions` object. Previously, denied actions could appear as `false` due to proto3 default value behavior; now they are simply absent. Clients that check `actions.can_edit === true` are unaffected. Clients that check `"can_edit" in actions` should verify the value is `true`.
39
+
-**Entity existence checks**: Permissions endpoints now return "not found" for non-existent entity IDs, even for global admins. Previously, global admins could query permissions on any ID without an existence check.
40
+
-**Parse error handling**: Permission mutation endpoints (`POST/DELETE .../permissions`) now correctly return an error and stop processing if the JSON request body is malformed. Previously, a parse failure could fall through and attempt the operation with zero values.
0 commit comments