#250 - API permission filtering — scope /projects, /notes, /boards by user permissions - forgejo_admin/pal-e-api

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

forgejo_admin/pal-e-api#250

forgejo_admin commented

2026-03-30 22:10:10 +00:00

Owner

Type

Feature

Lineage

Depends on UserProjectPermission table (pal-e-api sibling issue).

Repo

forgejo_admin/pal-e-api

User Story

As a stakeholder
I want to see only the projects and boards assigned to me
So that I'm not overwhelmed with content I don't need

Context

Once UserProjectPermission exists, the API must filter responses based on the authenticated user's permissions. Extract keycloak_sub from Bearer JWT, query UserProjectPermission, return only permitted projects/notes/boards. Public content (is_public=true) bypasses this filter. Superadmin bypasses all checks. See arch-dataflow-pal-e-app.

File Targets

Files to modify:

src/pal_e_docs/routes/projects.py — filter project list by user permissions
src/pal_e_docs/routes/notes.py — filter notes by project permissions
src/pal_e_docs/routes/boards.py — filter boards by project permissions
src/pal_e_docs/deps.py or similar — JWT extraction, permission check dependency

Files NOT to touch:

MCP server code — uses service account, not user tokens

Acceptance Criteria

GET /projects returns only permitted projects plus is_public projects
GET /notes filters by project scope
GET /boards filters by project scope
GET /boards/{slug}/items returns 403 if user lacks project access
Unauthenticated requests see only is_public content (preserved)
Superadmin bypass works

Test Expectations

Unit test: permission filtering logic
Integration test: auth requests with/without permissions
Run command: pytest tests/ -k test_permission_filter

Constraints

Must not break existing MCP server or unauthenticated access
Permission check should be a reusable FastAPI dependency

Checklist

PR opened
Tests pass
No unrelated changes

project-pal-e-app
arch-dataflow-pal-e-app

### Type Feature ### Lineage Depends on UserProjectPermission table (pal-e-api sibling issue). ### Repo `forgejo_admin/pal-e-api` ### User Story As a stakeholder I want to see only the projects and boards assigned to me So that I'm not overwhelmed with content I don't need ### Context Once UserProjectPermission exists, the API must filter responses based on the authenticated user's permissions. Extract keycloak_sub from Bearer JWT, query UserProjectPermission, return only permitted projects/notes/boards. Public content (is_public=true) bypasses this filter. Superadmin bypasses all checks. See arch-dataflow-pal-e-app. ### File Targets Files to modify: - `src/pal_e_docs/routes/projects.py` — filter project list by user permissions - `src/pal_e_docs/routes/notes.py` — filter notes by project permissions - `src/pal_e_docs/routes/boards.py` — filter boards by project permissions - `src/pal_e_docs/deps.py` or similar — JWT extraction, permission check dependency Files NOT to touch: - MCP server code — uses service account, not user tokens ### Acceptance Criteria - [ ] GET /projects returns only permitted projects plus is_public projects - [ ] GET /notes filters by project scope - [ ] GET /boards filters by project scope - [ ] GET /boards/{slug}/items returns 403 if user lacks project access - [ ] Unauthenticated requests see only is_public content (preserved) - [ ] Superadmin bypass works ### Test Expectations - [ ] Unit test: permission filtering logic - [ ] Integration test: auth requests with/without permissions - Run command: `pytest tests/ -k test_permission_filter` ### Constraints - Must not break existing MCP server or unauthenticated access - Permission check should be a reusable FastAPI dependency ### Checklist - [ ] PR opened - [ ] Tests pass - [ ] No unrelated changes ### Related - `project-pal-e-app` - `arch-dataflow-pal-e-app`

forgejo_admin referenced this issue

2026-04-13 00:13:14 +00:00

feat: dual auth — accept Keycloak JWT alongside API key #269

2026-04-13 14:54:16 +00:00

feat: user attribution on notes — track who creates and edits #272