feat: require explicit dashboard read permission

2026-08-24 01:15:42 +02:00
parent 1a48724f16
commit ec240ed219
11 changed files with 165 additions and 12 deletions
@@ -9,6 +9,10 @@ Configurable dashboard module for GovOPlaN.
 The module owns the `/dashboard` route when installed. Core keeps only a minimal
 fallback home for installations where this module is absent.

+Opening the route and using its personal-layout API requires the grantable
+`dashboard:dashboard:read` tenant permission. The `dashboard_user` role template
+contains this permission; widgets retain their own provider-specific access checks.
+
 Modules contribute widgets through the `dashboard.widgets` WebUI capability.
 Personal widget layouts are stored by the backend for each tenant, account, and
 active View. Configure mode supports adding, removing, ordering, sizing, and