From 1ca13fb46c1afba2f6b0fa37ed6aff5684f0b142 Mon Sep 17 00:00:00 2001 From: pikann22 Date: Sun, 11 Oct 2026 08:44:56 +0000 Subject: [PATCH 1/2] feat: move route gates and permission keys to IAM actions Co-Authored-By: Claude Sonnet 5.5 --- backend/webhook.go | 2 +- plugin.json | 80 +++++++++++++++++++++++----------------------- 2 files changed, 41 insertions(+), 41 deletions(-) diff --git a/backend/webhook.go b/backend/webhook.go index 39e7f8f..292c446 100644 --- a/backend/webhook.go +++ b/backend/webhook.go @@ -20,7 +20,7 @@ var branchTaskRefRe = regexp.MustCompile(`(?i)\b([A-Z][A-Z0-9]{1,19})-(\d{1,6})\ func (p *githubPlugin) receiveWebhook(req *plugin.Request, res *plugin.Response) { // projectId comes from the URL the integration registered with GitHub - // (.../projects/:projectId/webhook) — this route has no requirePermissions + // (.../projects/:projectId/webhook) — this route has no requireActions // middleware (GitHub itself calls it, with no Paca auth), so // req.Caller.ProjectID is never populated here; the path segment is the // only source of truth for which project this delivery is for. diff --git a/plugin.json b/plugin.json index 0dc7d6e..830bbdf 100644 --- a/plugin.json +++ b/plugin.json @@ -8,7 +8,7 @@ "permissions": ["db.read", "db.write"], "customPermissions": [ { - "key": "github.manage", + "key": "github:manage", "label": "Manage GitHub integration", "description": "View and manage this project's GitHub integration: connect or disconnect the access token, and link or unlink repositories. Does not affect PR/branch info on individual tasks, which any project member with task access can already see.", "scope": "project" @@ -29,9 +29,9 @@ { "name": "optionalAuthn" }, { "name": "requireFreshPassword" }, { - "name": "requirePermissions", + "name": "requireActions", "scope": "project", - "permissions": ["github.manage"] + "actions": ["github:manage"] } ] }, @@ -42,9 +42,9 @@ { "name": "optionalAuthn" }, { "name": "requireFreshPassword" }, { - "name": "requirePermissions", + "name": "requireActions", "scope": "project", - "permissions": ["github.manage"] + "actions": ["github:manage"] } ] }, @@ -55,9 +55,9 @@ { "name": "optionalAuthn" }, { "name": "requireFreshPassword" }, { - "name": "requirePermissions", + "name": "requireActions", "scope": "project", - "permissions": ["github.manage"] + "actions": ["github:manage"] } ] }, @@ -68,9 +68,9 @@ { "name": "optionalAuthn" }, { "name": "requireFreshPassword" }, { - "name": "requirePermissions", + "name": "requireActions", "scope": "project", - "permissions": ["github.manage"] + "actions": ["github:manage"] } ] }, @@ -81,9 +81,9 @@ { "name": "optionalAuthn" }, { "name": "requireFreshPassword" }, { - "name": "requirePermissions", + "name": "requireActions", "scope": "project", - "permissions": ["github.manage"] + "actions": ["github:manage"] } ] }, @@ -94,9 +94,9 @@ { "name": "optionalAuthn" }, { "name": "requireFreshPassword" }, { - "name": "requirePermissions", + "name": "requireActions", "scope": "project", - "permissions": ["github.manage"] + "actions": ["github:manage"] } ] }, @@ -107,9 +107,9 @@ { "name": "optionalAuthn" }, { "name": "requireFreshPassword" }, { - "name": "requirePermissions", + "name": "requireActions", "scope": "project", - "permissions": ["github.manage"] + "actions": ["github:manage"] } ] }, @@ -120,9 +120,9 @@ { "name": "optionalAuthn" }, { "name": "requireFreshPassword" }, { - "name": "requirePermissions", + "name": "requireActions", "scope": "project", - "permissions": ["github.manage"] + "actions": ["github:manage"] } ] }, @@ -133,9 +133,9 @@ { "name": "optionalAuthn" }, { "name": "requireFreshPassword" }, { - "name": "requirePermissions", + "name": "requireActions", "scope": "project", - "permissions": ["tasks.read"] + "actions": ["tasks:read"] } ] }, @@ -146,9 +146,9 @@ { "name": "optionalAuthn" }, { "name": "requireFreshPassword" }, { - "name": "requirePermissions", + "name": "requireActions", "scope": "project", - "permissions": ["tasks.write"] + "actions": ["tasks:write"] } ] }, @@ -159,9 +159,9 @@ { "name": "optionalAuthn" }, { "name": "requireFreshPassword" }, { - "name": "requirePermissions", + "name": "requireActions", "scope": "project", - "permissions": ["tasks.write"] + "actions": ["tasks:write"] } ] }, @@ -172,9 +172,9 @@ { "name": "optionalAuthn" }, { "name": "requireFreshPassword" }, { - "name": "requirePermissions", + "name": "requireActions", "scope": "project", - "permissions": ["tasks.write"] + "actions": ["tasks:write"] } ] }, @@ -185,9 +185,9 @@ { "name": "optionalAuthn" }, { "name": "requireFreshPassword" }, { - "name": "requirePermissions", + "name": "requireActions", "scope": "project", - "permissions": ["tasks.read"] + "actions": ["tasks:read"] } ] }, @@ -198,9 +198,9 @@ { "name": "optionalAuthn" }, { "name": "requireFreshPassword" }, { - "name": "requirePermissions", + "name": "requireActions", "scope": "project", - "permissions": ["tasks.read"] + "actions": ["tasks:read"] } ] }, @@ -211,9 +211,9 @@ { "name": "optionalAuthn" }, { "name": "requireFreshPassword" }, { - "name": "requirePermissions", + "name": "requireActions", "scope": "project", - "permissions": ["tasks.write"] + "actions": ["tasks:write"] } ] }, @@ -224,9 +224,9 @@ { "name": "optionalAuthn" }, { "name": "requireFreshPassword" }, { - "name": "requirePermissions", + "name": "requireActions", "scope": "project", - "permissions": ["tasks.write"] + "actions": ["tasks:write"] } ] }, @@ -237,9 +237,9 @@ { "name": "optionalAuthn" }, { "name": "requireFreshPassword" }, { - "name": "requirePermissions", + "name": "requireActions", "scope": "project", - "permissions": ["tasks.read"] + "actions": ["tasks:read"] } ] }, @@ -250,9 +250,9 @@ { "name": "optionalAuthn" }, { "name": "requireFreshPassword" }, { - "name": "requirePermissions", + "name": "requireActions", "scope": "project", - "permissions": ["tasks.write"] + "actions": ["tasks:write"] } ] }, @@ -263,9 +263,9 @@ { "name": "optionalAuthn" }, { "name": "requireFreshPassword" }, { - "name": "requirePermissions", + "name": "requireActions", "scope": "project", - "permissions": ["tasks.write"] + "actions": ["tasks:write"] } ] }, @@ -284,7 +284,7 @@ "component": "GitHubSettingsTab", "label": "GitHub", "order": 100, - "requiredPermission": "github.manage" + "requiredPermission": "github:manage" }, { "point": "task.detail.section", From 4abb2be0f4c685182a514d83da1970319586a5ae Mon Sep 17 00:00:00 2001 From: pikann22 Date: Sun, 11 Oct 2026 08:49:27 +0000 Subject: [PATCH 2/2] chore: bump to 0.4.1 and require core v0.19.0 Co-Authored-By: Claude Sonnet 5.5 --- plugin.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/plugin.json b/plugin.json index 830bbdf..31a14b0 100644 --- a/plugin.json +++ b/plugin.json @@ -2,8 +2,8 @@ "id": "com.paca.github", "displayName": "GitHub Integration", "description": "Integrates GitHub repositories, pull requests, and branches with Paca projects and tasks.", - "version": "0.4.0", - "minCoreVersion": "v0.13.3", + "version": "0.4.1", + "minCoreVersion": "v0.19.0", "capabilities": ["repository"], "permissions": ["db.read", "db.write"], "customPermissions": [