web-mojo 2.6.1 → 2.6.3

package/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 ## Unreleased
 
+### Admin · MemberView — Audit gate widened to LogList perms + Edit-membership action (ITEM-026)
+
+- **The Member detail "Audit" section no longer hides itself from `security`- or `manage_logs`-only operators.** It gated on a bare `permissions: 'view_logs'`, narrower than the server `LogList` VIEW_PERMS `[manage_logs, view_logs, security, admin]` (`django-mojo apps/logit/models/log.py`) — so an operator holding e.g. `security` was denied the tab client-side even though the API would serve them (fail-closed, no data leak, but a real capability loss for security-specialist roles). The SideNav **section descriptor** (the effective gate, via `SideNavView._isSectionAllowed` → `checkPermissions`) and the underlying `TableView` now both mirror the server list.
+- **New "Edit membership" kebab action** on `MemberView` — edits a member's Role (`metadata.role`) via `showModelForm`, refreshing the header subtitle on a successful save. Role only: `is_active` stays on the header active switch (the ITEM-025 convention — never in an edit form) and Display Name is a User field owned by `UserView`, so the shared `Member.EDIT_FORM` is deliberately left untouched (other consumers unaffected).
+- Tests: `test/unit/MemberView.test.js` (6 behavioral tests — kebab action list, the Audit gate array on both the section descriptor and the TableView, the role-only edit form, and header-refresh-only-on-success). Test-infra: `MemberView` registered in `simple-module-loader`, plus the missing `models/Log.js → LogList` path mapping (a named `{ LogList }` import was transforming to `const LogList = undefined`, breaking constructor-time `new LogList()`).
+
+### Admin · API Key permissions: Member-parity switch editor + ApiKeyView DetailView migration (ITEM-025)
+
+- **The permissions JSON textarea is gone — it was corrupting data.** `ApiKeyForms.create`/`.edit` declared `permissions` as `type: 'textarea'`: an already-fetched permissions object string-coerced to the literal text `[object Object]` on Edit, and the raw textarea string was POSTed with no `JSON.parse` — so even a name-only save silently overwrote real permissions with a garbage string. Both dialogs (GroupView → API Keys and the standalone admin ApiKeys table) had the bug.
+- **Permissions are now edited exactly like Group Member permissions.** An API key "acts as" a member of its group, so the editor offers the Member permission catalog and nothing else: the create form embeds the live `Member.PERMISSION_TABSET` switch tabset (a `fields` getter, so app permissions registered later via `Member.registerPermissions()` appear automatically), and each switch saves a flat dotted `permissions.<name>` boolean — the same wire shape MemberView autosaves, expanded and gated per-key by django-mojo. Creates are grant-only: unchecked switches are stripped from the POST. `ApiKeyForms.edit` shrinks to name-only.
+- **`ApiKeyView` rebuilt on `DetailView`** (was a pre-DetailView hand-rolled `View`), matching the 13 sibling admin detail views: real header with × close (the old modal had no close affordance and grew a stray default "OK" footer button), `is_active` on the header active switch, kebab reduced to Edit name / Delete, and sections — Overview (key facts + token note), Permissions (autosaving `Member.PERMISSION_TABSET` FormView, the landing section), Rate Limits (read-only), Usage. Dark-theme support comes free from the DetailView primitives. `ApiKeyTablePage` completes `viewDialogOptions` with `noBodyPadding: true, buttons: []` — correct **only** together with this migration (on the old hand-rolled view those options removed all padding and every dismiss control, which is precisely how the GroupView path looked broken).
+- GroupView's one-time token-reveal dialog now receives the granted permission names extracted from the dotted create-form keys (the old dict/JSON-string juggling is gone).
+- **Known contingency:** a member holding only `"groups"` can create a key but still 403s when granting permissions until the two django-mojo companion fixes land (setter drops non-dict values; permission-gate fallback list omits base perms) — tracked in ITEM-025's notes.
+- Tests: `test/unit/ApiKey.test.js` (regression: no permissions textarea anywhere, live tabset embed, name-only edit), `test/unit/ApiKeyView.test.js` (DetailView structure, × close, live-tabset autosave FormView, corrupted-permissions guard). Docs: `models/BuiltinModels.md` (ApiKey section rewritten — correct endpoint, form helpers).
+
 ### Admin · Storage upload limit configurable — 1 GB default, app-level `max_upload_size` (ITEM-024)
 
 - **The Files page (`system/files`) upload cap is no longer hardcoded at 100 MB.** Both upload paths (drag-drop and the Add file picker) now share one resolved limit with the precedence *page option `maxFileSize` → WebApp config `max_upload_size` → 1 GB default*. A 143 MB upload that previously errored ("File size (142.93 MB) exceeds maximum (100 MB)") now passes on default config; deployments needing a different ceiling set `new WebApp({ max_upload_size: N })` (PortalApp/PortalWebApp share the same config object) or pass `maxFileSize` at `registerPage` time. Both error messages report the effective limit.