Merge pull request #129 from niteeshkanna-sh/claude/stoic-rubin-fnglq7

Permissions, not just a role, when adding somebody

Author: niteeshkanna-sh

admin/admin.css

@@ -972,9 +972,86 @@ label.finance-toggle {
   border: 1px solid var(--border); border-radius: 9px;
 }
 
-.u-new { max-width: 640px; }
+.u-new { max-width: 920px; }
+.u-new .modal-row, .u-new > .field-group:not(.u-perm-block) { max-width: 640px; }
 .u-new .field-group { margin-bottom: 12px; }
 
+/* ---------- Who may do what ---------- */
+
+/* One person per row, shut unless they are an exception to their role. An
+   account that is exactly its role has nothing to read, and twenty-seven
+   ticks saying "yes, the standard" is twenty-seven things to scan past to
+   reach the one person somebody opened this page for. */
+.u-perm-person {
+  border: 1px solid var(--border); border-radius: 12px;
+  padding: 0 14px; margin-bottom: 10px; background: var(--surface);
+}
+.u-perm-person > summary {
+  display: flex; align-items: center; gap: 10px; flex-wrap: wrap;
+  padding: 13px 0; cursor: pointer; list-style: none;
+}
+.u-perm-person > summary::-webkit-details-marker { display: none; }
+.u-perm-person > summary::after {
+  content: '+'; margin-left: auto; color: var(--ink-faint);
+  font-weight: 700; font-size: 1.05rem; line-height: 1;
+}
+.u-perm-person[open] > summary::after { content: '\2212'; }
+.u-perm-person[open] > summary { border-bottom: 1px solid var(--border); }
+.u-perm-person > :not(summary) { margin: 14px 0; }
+.u-perm-name { font-weight: 700; }
+.u-perm-person > summary .field-hint { margin: 0; }
+.u-perm-role { font-size: 0.82rem; color: var(--ink-dim); }
+
+/* The tally under a role in the table above: "2 added, 1 removed". */
+.u-perm-tally { display: block; margin-top: 3px; }
+
+/* Columns that fit what is in them rather than a fixed count: eight groups of
+   between one and five permissions, which at one column each on a desk leaves
+   Reports as a column of one, and at four fixed columns on a phone is
+   unreadable. */
+.u-perm-grid {
+  display: grid; gap: 12px;
+  grid-template-columns: repeat(auto-fit, minmax(230px, 1fr));
+}
+.u-perm-group {
+  border: 1px solid var(--border); border-radius: 11px;
+  padding: 10px 13px 12px; margin: 0; min-width: 0;
+}
+.u-perm-group legend {
+  font-size: 0.71rem; font-weight: 700; text-transform: uppercase;
+  letter-spacing: 0.04em; color: var(--ink-faint); padding: 0 5px;
+}
+/* Written as .u-perm-grid .u-perm rather than .u-perm so it outranks
+   ".field-group label { display: block }", which the create form's copy of
+   this grid sits inside. Without it the tick box stops being the start of a
+   row and the words wrap underneath it. */
+.u-perm-grid .u-perm {
+  display: flex; align-items: flex-start; gap: 9px; margin: 0;
+  padding: 5px 0; font-size: 0.85rem; font-weight: 500; color: var(--ink);
+  cursor: pointer; line-height: 1.35;
+}
+.u-perm-grid .u-perm input[type="checkbox"] {
+  margin: 1px 0 0; flex-shrink: 0; width: 16px; height: 16px;
+  accent-color: var(--primary);
+}
+.u-perm-grid .u-perm input:disabled { cursor: default; }
+.u-perm-grid .u-perm input:disabled + span { color: var(--ink-faint); }
+
+/* The ones that remove something, or change a figure already counted. Marked
+   rather than separated out: they belong beside the thing they undo, and a
+   "dangerous" group of its own invites being ticked as a group. */
+.u-perm-grid .u-perm.is-weighty > span::after {
+  content: ''; display: inline-block; vertical-align: middle;
+  width: 5px; height: 5px; border-radius: 50%;
+  background: var(--danger); opacity: 0.55; margin-left: 6px;
+}
+
+.u-perm-save { display: flex; gap: 8px; flex-wrap: wrap; align-items: center; }
+
+@media (max-width: 560px) {
+  .u-perm-grid { grid-template-columns: 1fr; }
+}
+
 /* ---------- Bookings ---------- */
 
 .booking-card {

admin/sql/017_user_abilities.sql

@@ -0,0 +1,40 @@
+-- What one person may do that their role does not say.
+--
+-- Five roles covered the business while everybody fitted one of them. They
+-- stop covering it the moment somebody nearly fits: the person who runs the
+-- counter and is also trusted to take the cash, the relative who should see
+-- the expenses and touch nothing. Both of those were a choice between a role
+-- that does too little and one that does far too much, and the panel had no
+-- third answer.
+--
+-- One row per difference, not per permission. An account with no rows is
+-- exactly its role, which is almost all of them; an account with two rows is
+-- "Accounts, and may also cancel a booking". Storing the differences rather
+-- than a snapshot of the whole set is what keeps that sentence true after the
+-- meaning of a role changes -- a snapshot would silently freeze whatever the
+-- role happened to grant on the day the account was made.
+--
+-- granted is 1 for something the role does not give and this person has, 0
+-- for something the role gives and this person does not. There is no third
+-- value: "as the role says" is the absence of a row.
+CREATE TABLE IF NOT EXISTS user_abilities (
+  user_id    INT UNSIGNED NOT NULL,
+
+  -- The permission as the server asks for it: 'payment.create'. Deliberately
+  -- not a foreign key to a table of permissions -- the catalogue lives in
+  -- src/abilities.php next to the code that enforces it, and a row naming a
+  -- permission that no longer exists is ignored rather than fatal.
+  ability    VARCHAR(40)  NOT NULL,
+
+  granted    TINYINT(1)   NOT NULL,
+
+  created_at DATETIME     NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  updated_at DATETIME     NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+
+  -- One answer per person per permission, enforced here rather than trusted
+  -- to the code: two rows disagreeing about whether somebody may void a
+  -- payment is not a question the server should ever have to resolve.
+  PRIMARY KEY (user_id, ability),
+
+  CONSTRAINT fk_user_abilities_user FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;