The LINBO section is RoleChecker("G") throughout — 26 routes, including linbo-groups, startconfs (read, write, delete), configs, images and the image sidecar/backup routes. School administrators cannot reach any of them.
In linuxmuster-webui7 they can. The LINBO 4 plugin guards its views with @authorize('lm:linbo:configs') and lm:linbo:images, and plugins/lmn_linbo4/permissions.yml grants both to school administrators by default:
schooladministrator:
- 'lm:linbo:configs: true'
- 'lm:linbo:examples: true'
- 'lm:linbo:icons: true'
- 'lm:linbo:images: true'
- 'sidebar:view:/view/lmn/linbo4: true'
A school admin who manages LINBO in the Schulkonsole today gets a 403 from the API for the same task.
Why this is not simply an oversight to wave through
Hardware groups are global: one directory, one file per group, Group not scoped to a school. A school admin editing start.conf.raum101 edits it for everybody. Widening the role without a scope would hand every school admin write access to every other school's groups.
The scoping information exists. Devices(school).groups already yields the groups a school's devices actually reference — the same call GET /grub-configs uses to filter per school:
@router.get("/grub-configs", name="All GRUB configs for a school")
@require_school
def get_all_grub_configs(school: str = "default-school", who=Depends(RoleChecker("GS"))):
school_groups = Devices(school=school).groupsThat route is already "GS" and already scoped. The start.conf routes could follow the same pattern.
Suggestion
For GET /linbo-groups, GET /startconfs, POST /startconfs/{group_id}, DELETE /startconfs/{group_id} and the image management routes: RoleChecker("GS"), with school administrators restricted to the groups their own school's devices.csv references, and global administrators unrestricted as today.
Where that restriction is not wanted for the images (an image is shared, not owned by a school), read access for "GS" and write for "G" would still close the larger half of the gap.
We are building the LINBO group and image management in edulution-ui against these routes and would rather match the Schulkonsole's roles than ship a narrower product. Happy to prepare the PR if the direction is right.
The LINBO section is
RoleChecker("G")throughout — 26 routes, includinglinbo-groups,startconfs(read, write, delete),configs,imagesand the image sidecar/backup routes. School administrators cannot reach any of them.In
linuxmuster-webui7they can. The LINBO 4 plugin guards its views with@authorize('lm:linbo:configs')andlm:linbo:images, andplugins/lmn_linbo4/permissions.ymlgrants both to school administrators by default:A school admin who manages LINBO in the Schulkonsole today gets a 403 from the API for the same task.
Why this is not simply an oversight to wave through
Hardware groups are global: one directory, one file per group,
Groupnot scoped to a school. A school admin editingstart.conf.raum101edits it for everybody. Widening the role without a scope would hand every school admin write access to every other school's groups.The scoping information exists.
Devices(school).groupsalready yields the groups a school's devices actually reference — the same callGET /grub-configsuses to filter per school:That route is already
"GS"and already scoped. The start.conf routes could follow the same pattern.Suggestion
For
GET /linbo-groups,GET /startconfs,POST /startconfs/{group_id},DELETE /startconfs/{group_id}and the image management routes:RoleChecker("GS"), with school administrators restricted to the groups their own school'sdevices.csvreferences, and global administrators unrestricted as today.Where that restriction is not wanted for the images (an image is shared, not owned by a school), read access for
"GS"and write for"G"would still close the larger half of the gap.We are building the LINBO group and image management in edulution-ui against these routes and would rather match the Schulkonsole's roles than ship a narrower product. Happy to prepare the PR if the direction is right.