* feat: add per-user module permissions (RBAC) with admin bypass
Introduce a module-level permission system so non-admin users can be
scoped to a subset of dashboard modules. Adds a `permissions` TEXT column
on the `users` table (migration 006, SQLite + PostgreSQL), a central
permission catalog in `infra/users/permissions.py`, backend ACL checks
across routers, and dashboard gating via `RequirePermission` /
`ForbiddenPage` keyed by nav module. `admin` always bypasses every gate;
read access and chat/agent use are never gated.
* fix: gate connector install-cli by connectors permission (not admin-only)
The host CLI installer is a connectors-module operation and should be
gated by the `connectors` module permission, consistent with the rest of
the connector routes, instead of being admin-only.
The earlier RBAC change demoted this route from `current_admin` but the
test `test_install_cli_forbidden_for_non_admin` still failed because the
`create_user` test helper grants `BASELINE_PERMISSIONS` (which includes
`connectors`) by default, so the "non-admin" user actually held the
permission. Gate the route with `require_permission("connectors")` and
create the test user with `permissions=[]` so it genuinely lacks the
key and is rejected with 403.
---------
Co-authored-by: jubaoliang <jubaoliang@tencent.com>
CI:
- Drop Python 3.11 from the test matrix (package requires >=3.12); the
3.11 jobs failed at `uv sync`. Linux and Windows now test Python 3.12.
- Rename tests/unit/infra/setup/tls/test_store.py -> test_tls_store.py to
fix the pytest import collision (duplicate basename) that aborted
collection on the 3.12 job.
Source bugs uncovered by the suite:
- Move ACTOR_SYSTEM to a runtime import in infra/cron/job.py (was wrongly
placed under TYPE_CHECKING, causing NameError at runtime).
- Add missing users-table columns (login_failed_count, login_locked_until,
preferences_json) in infra/db/migrate.py for legacy schema repair.
- Make auth.update_me honor explicit nulls via model_dump(exclude_unset=True).
- Relax skills hub endpoints to existence/ownership checks (require_agent_row)
instead of requiring the agent to be running.
- Marshal WebSocket frames onto the owning event loop in chat/ws.py so the
starlette TestClient portal does not deadlock.
- Include error details in the browser session 503 response.
Tests:
- Update tests to match current source APIs (harness async create/remove/
rebuild, FakeHarnessAgent skill methods, workspace nested layout, JWT
middleware, CLI surface, proactive config defaults, general-assistant
template manifest).
- Migrate WebSocket tests to starlette TestClient(...).websocket_connect
(httpx 0.28 removed AsyncClient.websocket_connect).
- Skip memory API tests when the optional harness_memory dependency is absent
via pytest.importorskip.
- Remove the invalid diagnostic test tests/integration/test_diag_e2e.py
(no assertions; inspected private internals only).
Also includes the pre-existing uncommitted orca -> Octop rename across docs,
README, LICENSE, Dockerfile and docker assets, as requested.
