pal-e-docs
Project not found.

Phase 1: Playground Auth Flow + Role-Based Views

phase-minio-mobile-1-playground-auth Phase

phase
Project
Goal: Update the existing minio-playground with a signin page, demo account links, and role-based views (admin vs stakeholder) — following the westside-playground auth flow pattern.
Owner: Dev agent
Repo: forgejo_admin/minio-playground
Depends on: None (playground v1 already merged)

Scope

Auth Flow Pages (westside pattern)

  • signin.html — login form (non-functional prototype) with Demo Account links: "Sign in as Admin", "Sign in as Stakeholder (Westside)", "Sign in as Stakeholder (MCD Tracker)"
  • HTML comments documenting @route, @auth, @api, @interactivity, @gaps, @notes (westside convention)
  • Post-login redirect logic documented: Keycloak OIDC → token claims → role-based routing

Role-Based Views

  • Admin view — sees all buckets (assets, postgres-wal, tf-state-backups), full CRUD, user management link
  • Stakeholder view — sees only their project prefix (e.g., assets/westside/), read + upload, no delete, no other buckets
  • Navigation adapts per role (admin nav vs stakeholder nav)
  • Stakeholder name shown in header ("Westside Basketball" not "assets/westside/")

Updated Pages

  • Existing pages (index, browse, preview, upload, detail) updated to show role-appropriate content
  • Stakeholder landing = their project's file browser directly (skip bucket list)
  • Admin landing = bucket list (existing index.html)

File Structure (unchanged constraint)

  • One style.css, one app.js, HTML files per page
  • No npm, no frameworks, no build step
  • Served with python3 -m http.server 8080

Deliverables

  • PR #5 merged (squash) — 2026-03-21
  • signin.html with demo accounts: Admin, Stakeholder (Westside), Stakeholder (MCD Tracker)
  • Role state management via URL params + sessionStorage
  • Admin view: all buckets, full CRUD. Stakeholder view: scoped prefix, read + upload only
  • escapeHtml() on all URL-derived innerHTML (XSS fix, passed re-review)
  • isAllowedPath() enforced on all page renderers (access control fix, passed re-review)
  • HTML comments with @route, @auth, @interactivity annotations (westside pattern)
  • plan-minio-mobile — parent plan
  • phase-pal-e-platform-26-minio-playground — playground v1 (completed)
  • project-frontend-playground — playground CSS paradigm
  • westside-playground signin.html — reference implementation for auth flow pattern