Feature: page access groups with RBAC-based visibility control

migrations/20260508120000_add_access_groups.ts

@@ -0,0 +1,105 @@
+import type { Knex } from "knex";
+
+export async function up(knex: Knex): Promise<void> {
+  // Access groups define visibility scopes for pages.
+  // "public" = visible to everyone without login.
+  // "admin" = grants access to all pages (assigned to admin role).
+  if (!(await knex.schema.hasTable("access_groups"))) {
+    await knex.schema.createTable("access_groups", (table) => {
+      table.string("id", 100).primary();
+      table.text("group_name").notNullable();
+      table.text("description");
+      table.integer("is_system").notNullable().defaultTo(0);
+      table.timestamp("created_at").defaultTo(knex.fn.now());
+      table.timestamp("updated_at").defaultTo(knex.fn.now());
+    });
+  }
+
+  // Junction: which access groups are assigned to which page
+  if (!(await knex.schema.hasTable("page_access_groups"))) {
+    await knex.schema.createTable("page_access_groups", (table) => {
+      table.integer("page_id").unsigned().notNullable()
+        .references("id").inTable("pages").onDelete("CASCADE");
+      table.string("access_group_id", 100).notNullable()
+        .references("id").inTable("access_groups").onDelete("CASCADE");
+      table.timestamp("created_at").defaultTo(knex.fn.now());
+
+      table.primary(["page_id", "access_group_id"]);
+    });
+  }
+
+  // Junction: which access groups a role can see
+  if (!(await knex.schema.hasTable("role_access_groups"))) {
+    await knex.schema.createTable("role_access_groups", (table) => {
+      table.string("role_id", 100).notNullable()
+        .references("id").inTable("roles").onDelete("CASCADE");
+      table.string("access_group_id", 100).notNullable()
+        .references("id").inTable("access_groups").onDelete("CASCADE");
+      table.timestamp("created_at").defaultTo(knex.fn.now());
+
+      table.primary(["role_id", "access_group_id"]);
+    });
+  }
+
+  // Seed the "public" system group
+  const publicExists = await knex("access_groups").where("id", "public").first();
+  if (!publicExists) {
+    await knex("access_groups").insert({
+      id: "public",
+      group_name: "Public",
+      description: "Pages with this group are visible to everyone without login",
+      is_system: 1,
+      created_at: knex.fn.now(),
+      updated_at: knex.fn.now(),
+    });
+  }
+
+  // Seed the "admin" system group
+  const adminExists = await knex("access_groups").where("id", "admin").first();
+  if (!adminExists) {
+    await knex("access_groups").insert({
+      id: "admin",
+      group_name: "Admin",
+      description: "Grants access to all pages regardless of their groups",
+      is_system: 1,
+      created_at: knex.fn.now(),
+      updated_at: knex.fn.now(),
+    });
+  }
+
+  // Assign "public" to all existing pages (backward compatibility)
+  const allPages = await knex("pages").select("id");
+  for (const page of allPages) {
+    const exists = await knex("page_access_groups")
+      .where({ page_id: page.id, access_group_id: "public" })
+      .first();
+    if (!exists) {
+      await knex("page_access_groups").insert({
+        page_id: page.id,
+        access_group_id: "public",
+        created_at: knex.fn.now(),
+      });
+    }
+  }
+
+  // Assign "admin" group to the admin role
+  const adminRoleExists = await knex("roles").where("id", "admin").first();
+  if (adminRoleExists) {
+    const alreadyAssigned = await knex("role_access_groups")
+      .where({ role_id: "admin", access_group_id: "admin" })
+      .first();
+    if (!alreadyAssigned) {
+      await knex("role_access_groups").insert({
+        role_id: "admin",
+        access_group_id: "admin",
+        created_at: knex.fn.now(),
+      });
+    }
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists("role_access_groups");
+  await knex.schema.dropTableIfExists("page_access_groups");
+  await knex.schema.dropTableIfExists("access_groups");
+}

src/lib/allPerms.ts

@@ -221,6 +221,15 @@ export const ACTION_PERMISSION_MAP: Record<string, string | null> = {
   updateRolePermissions: "roles.assign_permissions",
   addUserToRole: "roles.assign_users",
   removeUserFromRole: "roles.assign_users",
+
+  // Access Groups
+  getAccessGroups: "pages.read",
+  createAccessGroup: "roles.write",
+  deleteAccessGroup: "roles.write",
+  getPageAccessGroups: "pages.read",
+  setPageAccessGroups: "pages.write",
+  getRoleAccessGroups: "roles.read",
+  setRoleAccessGroups: "roles.write",
 };
 
 export const ROUTE_PERMISSION_MAP: Record<string, string | null> = {

src/lib/server/api-server/pages/get.ts

@@ -1,31 +1,34 @@
 import { json } from "@sveltejs/kit";
 import type { APIServerRequest } from "$lib/server/types/api-server";
-import { GetAllPages } from "$lib/server/controllers/pagesController";
+import { GetAccessiblePages } from "$lib/server/controllers/pagesController";
 import { GetSiteDataByKey } from "$lib/server/controllers/siteDataController";
+import { GetLoggedInSession } from "$lib/server/controllers/controller";
 import type { PageNavItem } from "$lib/server/controllers/dashboardController";
 import type { PageOrderingSettings } from "$lib/types/site";
 
 /**
  * GET /dashboard-apis/pages
- * Returns all pages as PageNavItem[] (page_title, page_path)
- * Respects pageOrderingSettings if enabled
+ * Returns pages the current user is allowed to see, respecting
+ * access groups and page ordering settings.
  */
-export default async function get(_req: APIServerRequest): Promise<Response> {
-  const allPagesData = await GetAllPages();
+export default async function get(req: APIServerRequest): Promise<Response> {
+  // Get the logged-in user from the session cookie (null if anonymous)
+  const user = req.cookies ? await GetLoggedInSession(req.cookies) : null;
+
+  // Get only pages the user can access
+  const accessiblePages = await GetAccessiblePages(user);
   const pageOrderingSettings = (await GetSiteDataByKey("pageOrderingSettings")) as PageOrderingSettings | null;
 
-  let orderedPages = allPagesData;
+  let orderedPages = accessiblePages;
 
   if (pageOrderingSettings?.enabled && pageOrderingSettings.order?.length > 0) {
     const orderMap = new Map(pageOrderingSettings.order.map((id, idx) => [id, idx]));
-    orderedPages = [...allPagesData].sort((a, b) => {
+    orderedPages = [...accessiblePages].sort((a, b) => {
       const aIdx = orderMap.get(a.id);
       const bIdx = orderMap.get(b.id);
-      // Pages in the order list come first, sorted by their position
       if (aIdx !== undefined && bIdx !== undefined) return aIdx - bIdx;
       if (aIdx !== undefined) return -1;
       if (bIdx !== undefined) return 1;
-      // Pages not in the order list keep their default order (by id)
       return a.id - b.id;
     });
   }

src/lib/server/controllers/pagesController.ts

@@ -1,18 +1,27 @@
 import db from "../db/db.js";
-import type { PageRecord, PageRecordInsert, PageMonitorRecord, PageMonitorRecordInsert } from "../types/db.js";
+import type {
+  PageRecord,
+  PageRecordInsert,
+  PageMonitorRecord,
+  PageMonitorRecordInsert,
+  UserRecordPublic,
+} from "../types/db.js";
+import { GetSiteDataByKey } from "./siteDataController.js";
 
 // ============ Page CRUD Operations ============
 
 /**
- * Create a new page
+ * Create a new page.
+ * When the site setting "autoPublicPages" is true (default),
+ * newly created pages automatically get the "public" access group.
  */
 export async function CreatePage(data: PageRecordInsert): Promise<PageRecord> {
   // Validate required fields
   if (data.page_path === undefined || data.page_path === null || !data.page_title || !data.page_header) {
     throw new Error("page_path, page_title, and page_header are required");
   }
 
-  // Make page_path URL-friendly: lowercase, replace spaces with hyphens, remove special chars (including leading slashes)
+  // Make page_path URL-friendly
   data.page_path = data.page_path
     .toLowerCase()
     .trim()
@@ -25,7 +34,15 @@ export async function CreatePage(data: PageRecordInsert): Promise<PageRecord> {
     throw new Error(`Page with path "${data.page_path}" already exists`);
   }
 
-  return await db.createPage(data);
+  const newPage = await db.createPage(data);
+
+  // Auto-assign "public" group to new pages (unless disabled in settings)
+  const autoPublic = await GetSiteDataByKey("autoPublicPages");
+  if (autoPublic !== false && autoPublic !== "false") {
+    await db.setPageAccessGroups(newPage.id, ["public"]);
+  }
+
+  return newPage;
 }
 
 /**
@@ -228,3 +245,176 @@ export async function GetPageByPathWithMonitors(
   const monitors = await db.getPageMonitorsExcludeHidden(page.id);
   return { page, monitors };
 }
+
+// ============ Access Group Operations ============
+
+// Reserved group ID: role with "admin" can see all pages
+const ADMIN_GROUP = "admin";
+// Reserved group ID: pages with "public" are visible without login
+const PUBLIC_GROUP = "public";
+
+/**
+ * Check if a user can access a specific page.
+ *
+ * Rules (evaluated top to bottom, first match wins):
+ *   1. Page has "public" group → allow (no login needed)
+ *   2. No login → redirect to sign-in
+ *   3. User's roles include the "admin" group → allow (admin sees everything)
+ *   4. Page has no access groups → denied (unconfigured pages are hidden)
+ *   5. Any overlap between page groups and role groups → allow
+ *   6. No overlap → denied
+ *
+ * Returns: "allow" | "login_required" | "denied"
+ */
+export async function CheckPageAccess(
+  page_id: number,
+  user: UserRecordPublic | null,
+): Promise<"allow" | "login_required" | "denied"> {
+  const pageGroups = await db.getAccessGroupsForPage(page_id);
+
+  // Rule 1: public pages are visible to everyone
+  if (pageGroups.includes(PUBLIC_GROUP)) {
+    return "allow";
+  }
+
+  // Rule 2: non-public pages require login
+  if (!user) {
+    return "login_required";
+  }
+
+  // Rule 3: admin group grants access to all pages
+  const roleGroups = await db.getAccessGroupsForRoles(user.role_ids);
+  if (roleGroups.includes(ADMIN_GROUP)) {
+    return "allow";
+  }
+
+  // Rule 4: pages with no groups are hidden (except for admin)
+  if (pageGroups.length === 0) {
+    return "denied";
+  }
+
+  // Rule 5+6: check for overlap between page and role groups
+  const hasAccess = pageGroups.some((pg) => roleGroups.includes(pg));
+  return hasAccess ? "allow" : "denied";
+}
+
+/**
+ * Get all pages that a user is allowed to see.
+ * Used by the page switcher to filter the dropdown.
+ */
+export async function GetAccessiblePages(
+  user: UserRecordPublic | null,
+): Promise<PageRecord[]> {
+  const allPages = await db.getAllPages();
+  if (allPages.length === 0) return [];
+
+  // Load access groups for all pages in one query
+  const pageIds = allPages.map((p) => p.id);
+  const pageGroupsMap = await db.getAccessGroupsForPages(pageIds);
+
+  // Load user's role groups (if logged in)
+  let roleGroups: string[] = [];
+  let isAdmin = false;
+  if (user) {
+    roleGroups = await db.getAccessGroupsForRoles(user.role_ids);
+    isAdmin = roleGroups.includes(ADMIN_GROUP);
+  }
+
+  return allPages.filter((page) => {
+    const groups = pageGroupsMap.get(page.id) || [];
+
+    // Public pages are visible to everyone
+    if (groups.includes(PUBLIC_GROUP)) return true;
+
+    // Non-public pages require login
+    if (!user) return false;
+
+    // Admin sees everything
+    if (isAdmin) return true;
+
+    // Pages with no groups are hidden
+    if (groups.length === 0) return false;
+
+    // Check if role groups overlap with page groups
+    return groups.some((g) => roleGroups.includes(g));
+  });
+}
+
+// ============ Access Group Admin Operations ============
+
+/**
+ * Get all access groups (for admin UI dropdowns)
+ */
+export async function GetAllAccessGroups() {
+  return await db.getAllAccessGroups();
+}
+
+/**
+ * Create a new access group
+ */
+export async function CreateAccessGroup(data: { id: string; group_name: string; description?: string }) {
+  if (!data.id || !data.group_name) {
+    throw new Error("id and group_name are required");
+  }
+
+  // Normalize ID: lowercase, hyphens, no special chars
+  data.id = data.id.toLowerCase().trim().replace(/\s+/g, "-").replace(/[^a-z0-9_-]/g, "");
+
+  if (data.id === "public") {
+    throw new Error("Cannot create a group with the reserved ID 'public'");
+  }
+
+  const existing = (await db.getAllAccessGroups()).find((g) => g.id === data.id);
+  if (existing) {
+    throw new Error(`Access group '${data.id}' already exists`);
+  }
+
+  await db.createAccessGroup(data);
+  return { success: true, id: data.id };
+}
+
+/**
+ * Delete an access group. System groups (public, admin) cannot be deleted.
+ */
+export async function DeleteAccessGroup(id: string) {
+  const allGroups = await db.getAllAccessGroups();
+  const group = allGroups.find((g) => g.id === id);
+  if (!group) {
+    throw new Error(`Access group '${id}' not found`);
+  }
+  if ((group as any).is_system === 1) {
+    throw new Error(`Cannot delete system group '${id}'`);
+  }
+  await db.deleteAccessGroup(id);
+  return { success: true };
+}
+
+/**
+ * Get access groups assigned to a page
+ */
+export async function GetPageAccessGroups(page_id: number): Promise<string[]> {
+  return await db.getAccessGroupsForPage(page_id);
+}
+
+/**
+ * Set access groups for a page (replaces all existing assignments)
+ */
+export async function SetPageAccessGroups(page_id: number, group_ids: string[]) {
+  await db.setPageAccessGroups(page_id, group_ids);
+  return { success: true };
+}
+
+/**
+ * Get access groups assigned to a role
+ */
+export async function GetRoleAccessGroups(role_id: string): Promise<string[]> {
+  return await db.getAccessGroupsForRole(role_id);
+}
+
+/**
+ * Set access groups for a role (replaces all existing assignments)
+ */
+export async function SetRoleAccessGroups(role_id: string, group_ids: string[]) {
+  await db.setRoleAccessGroups(role_id, group_ids);
+  return { success: true };
+}