From acf38107f0ac72dd7a996d927ffbcde62189cd2c Mon Sep 17 00:00:00 2001 From: Thore Cimbal Date: Thu, 13 Aug 2026 12:00:00 +0000 Subject: [PATCH] feat(wiki): reader access to home page for wiki-anwender (#0048/#0049) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Betrieb/Anwender content structure is created (lives in git-storage, not the job). Add a page rule so wiki-anwender can read the home page besides /anwender — otherwise "/" would be denied for them. betrieb/* still matches no rule, so Wiki.js' default-deny keeps it invisible to users (verified in checkAccess: returns match && !deny). rule() gains a match param for the EXACT home rule. --- apps/production/wikijs-config.py | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/apps/production/wikijs-config.py b/apps/production/wikijs-config.py index 182c531..02c67c0 100644 --- a/apps/production/wikijs-config.py +++ b/apps/production/wikijs-config.py @@ -270,8 +270,8 @@ def ensure_group(jwt: str, name: str, perms: list, rules: list): log(f"Gruppe '{name}' -> Rechte+Seitenregeln gesetzt") -def rule(rid: str, deny: bool, perms: list, path: str): - return {"id": rid, "deny": deny, "match": "START", "roles": perms, +def rule(rid: str, deny: bool, perms: list, path: str, match: str = "START"): + return {"id": rid, "deny": deny, "match": match, "roles": perms, "path": path, "locales": []} @@ -288,7 +288,12 @@ def main(): # Erst Gruppen (Schreibvorgänge), DANN OIDC — ensure_oidc deaktiviert zuletzt local. # authentik Admins: alles lesen+schreiben. wiki-anwender: nur /anwender lesen. ensure_group(jwt, "authentik Admins", ADMIN_PERMS, [rule("adm", False, ["read:pages", "write:pages", "manage:pages"], "")]) - ensure_group(jwt, "wiki-anwender", READER_PERMS, [rule("anw", False, READER_PERMS, "anwender")]) + # wiki-anwender: nur den Anwender-Bereich lesen + die Startseite (sonst wäre "/" + # für sie gesperrt). betrieb/* matcht keine Regel -> Default-Deny (Abschottung). + ensure_group(jwt, "wiki-anwender", READER_PERMS, [ + rule("anw", False, READER_PERMS, "anwender"), + rule("anwhome", False, READER_PERMS, "home", match="EXACT"), + ]) # Guests (id 2) alle Rechte entziehen — Login-Pflicht, keine öffentliche Sicht. gql('mutation{groups{update(id:2,name:"Guests",redirectOnLogin:"/",permissions:[],pageRules:[]){responseResult{succeeded}}}}', jwt) ensure_oidc(jwt)