2.7 KiB
ACL and import backend design
Goal
Complete the administration ACL management and make every existing asset-import page functional end to end.
ACL architecture
acl_permissions, acl_roles, acl_model_permissions, and acl_model_roles are the only CMS authorization source. Emulator ranks remain in permission_ranks; each rank maps to the CMS role rank_<id>. Legacy website_permissions and website_housekeeping_permissions may be migrated but are not written by the new management flow.
The permissions screen manages emulator ranks, rank roles, role permission assignments, and direct user roles/permissions. Rank creation, editing, and deletion use the emulator rank service, refresh RCON permissions, invalidate the permission cache, and log staff activity. Every mutation requires admin.permissions.manage and fails closed.
Import authorization
All import pages and every /api/admin/import/** handler require admin.assets.import. Catalog deletion or repair operations that mutate catalog data additionally require admin.catalog.edit. Page-level checks are navigation guards only; API handlers repeat authorization before reading remote sources, writing the database, or writing files.
Import pipeline
Port the reference import core, services, API routes, and tests for badges, clone, clothing, effects, furni, pets, and repair. Adapt imports to EpicNext's generated Prisma names and locale-free routes. Do not copy generated Prisma files.
The furni success boundary is atomic at the workflow level: verify database rows, repository asset output, configured live Nitro asset output, and FurnitureData.json. External Windows paths use the existing cross-platform resolver. Repair/audit reports partial state instead of treating a database insert as success.
Migration
Add an idempotent migration that seeds admin.assets.import, normalizes ACL discriminator casing to Role and User, creates missing rank_<id> roles, migrates compatible legacy permission assignments, and grants the highest rank explicit management/import permissions. Dynamic highest-rank bypass remains an emergency compatibility path, not the persisted assignment model.
Error handling and verification
Remote download errors, invalid archives/data, filesystem failures, schema mismatches, and partial writes return structured errors and are logged without exposing secrets. Contract tests assert route coverage and server-side ACL guards. Service tests cover path resolution, batch behavior, data reconciliation, and fail-closed authorization. Final verification runs all tests, TypeScript, and the production build.
Scope boundary
This block does not add moderation, analytics, detailed logs, or DevOps pages. Those remain the next phase after ACL and imports are verified.