2 Commits

Author	SHA1	Message	Date
Joseph Doherty	7d989fb529	docs(security): script authoring and deploy are Administrator OR Designer (lmxopcua#779) ... The docs said script authoring was Admin-gated (VirtualTags.md "Known resource limits") and that a Designer "cannot publish" (security.md roles table). The code admits Designer to both: Scripts, ScriptEdit, EquipmentPage (virtual tags, scripted alarms), /api/script-analysis/* and Deployments all carry AdminUiPolicies.ConfigEditor = RequireRole("Administrator", "Designer"). That is a recorded decision, not drift: AdminUI-001 (98b27fc1) loosened the analysis backend from FleetAdmin to Administrator,Designer to match the page gate, and R2-05 converged the same pages on ConfigEditor "with the same semantics". So the docs follow the code: - VirtualTags.md: the primary control is ConfigEditor (Administrator or Designer), which also gates deploy. - security.md roles table: Designer = the whole ConfigEditor surface incl. scripts and deploy; Administrator = Designer + the FleetAdmin-only surface (role grants, API keys, certificate actions, manual failover) — the old "publish, cluster/node CRUD" were ConfigEditor all along. - 2026-06-09 Monaco plan: its FleetAdmin gate is marked superseded. Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV	2026-11-09 17:44:35 -05:00
Joseph Doherty	93aa6c2f81	docs(scripting): implementation plan for Roslyn-backed Monaco script editor ... 14-task plan: vendor Monaco + reusable MonacoEditor.razor, ScriptAnalysis backend re-seated on the real evaluator wrapper (ScriptSandbox + ForbiddenTypeAnalyzer + DependencyExtractor diagnostics), IScriptTagCatalog path completion, six Monaco providers, ScriptEdit + virtual-tag-modal wire-in, live docker-dev verification. Co-located .tasks.json for resume.	2026-06-09 13:56:59 -04:00