Harden module update compatibility cleanup

webui/src/utils/permissions.ts

@@ -1,6 +1,42 @@
 import type { AuthInfo } from "../types";
 
 const legacyToModuleScopes: Record<string, string> = {
+  "admin:users:read": "access:membership:read",
+  "admin:users:create": "access:membership:create",
+  "admin:users:update": "access:membership:update",
+  "admin:users:suspend": "access:membership:update",
+  "admin:groups:read": "access:group:read",
+  "admin:groups:write": "access:group:write",
+  "admin:groups:manage_members": "access:group:manage_members",
+  "admin:roles:read": "access:role:read",
+  "admin:roles:write": "access:role:write",
+  "admin:roles:assign": "access:role:assign",
+  "admin:api_keys:read": "access:api_key:read",
+  "admin:api_keys:create": "access:api_key:create",
+  "admin:api_keys:revoke": "access:api_key:revoke",
+  "admin:settings:read": "access:setting:read",
+  "admin:settings:write": "access:setting:write",
+  "admin:policies:read": "access:policy:read",
+  "admin:policies:write": "access:policy:write",
+  "system:tenants:read": "access:tenant:read",
+  "system:tenants:create": "access:tenant:create",
+  "system:tenants:update": "access:tenant:update",
+  "system:tenants:suspend": "access:tenant:suspend",
+  "system:accounts:read": "access:account:read",
+  "system:accounts:create": "access:account:create",
+  "system:accounts:update": "access:account:update",
+  "system:accounts:suspend": "access:account:suspend",
+  "system:roles:read": "access:system_role:read",
+  "system:roles:write": "access:system_role:write",
+  "system:roles:assign": "access:system_role:assign",
+  "system:access:read": "access:system_role:read",
+  "system:access:assign": "access:system_role:assign",
+  "system:audit:read": "access:audit:read",
+  "system:settings:read": "access:system_setting:read",
+  "system:settings:write": "access:system_setting:write",
+  "system:maintenance:access": "access:maintenance:access",
+  "system:governance:read": "access:governance:read",
+  "system:governance:write": "access:governance:write",
   "campaign:read": "campaigns:campaign:read",
   "campaign:create": "campaigns:campaign:create",
   "campaign:update": "campaigns:campaign:update",
@@ -40,6 +76,16 @@ const legacyToModuleScopes: Record<string, string> = {
 };
 
 const moduleToLegacyScopes = Object.fromEntries(Object.entries(legacyToModuleScopes).map(([legacy, module]) => [module, legacy]));
+const moduleSystemScopes = new Set(
+  Object.entries(legacyToModuleScopes)
+    .filter(([legacy]) => legacy.startsWith("system:"))
+    .map(([, module]) => module)
+);
+const moduleTenantScopes = new Set(
+  Object.entries(legacyToModuleScopes)
+    .filter(([legacy]) => !legacy.startsWith("system:"))
+    .map(([, module]) => module)
+);
 
 const legacyAliases: Record<string, string[]> = {
   "campaign:write": ["campaign:create", "campaign:update", "campaign:copy", "campaign:archive", "campaign:delete", "campaign:share", "recipients:read", "recipients:write", "recipients:import"],
@@ -63,9 +109,10 @@ function primitiveScopeGrants(granted: string, required: string): boolean {
   if (legacyAliases[granted]?.some((alias) => primitiveScopeGrants(alias, required))) return true;
   if (granted === "*") return true;
   if (granted === "tenant:*") {
-    return required === "tenant:*" || !required.startsWith("system:");
+    if (moduleSystemScopes.has(required)) return false;
+    return required === "tenant:*" || moduleTenantScopes.has(required) || !required.startsWith("system:");
   }
-  if (granted === "system:*") return required.startsWith("system:") || required.startsWith("access:");
+  if (granted === "system:*") return required.startsWith("system:") || moduleSystemScopes.has(required);
   if (granted.endsWith(":*") && required.startsWith(granted.slice(0, -1))) return true;
   return false;
 }
@@ -111,5 +158,8 @@ export const adminReadScopes = [
   "system:governance:read",
   "access:tenant:read",
   "access:account:read",
+  "access:system_role:read",
+  "access:audit:read",
+  "access:system_setting:read",
   "access:governance:read"
 ];