Skip to content

TIGER-335 batch 3: _isAdmin()→_isAllowed() in system + agent #352

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
WebTigers merged 2 commits into from
Oct 21, 2026
Merged

TIGER-335 batch 3: _isAdmin()→_isAllowed() in system + agent #352

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b6bdfb7
TIGER-335 batch 3: _isAdmin() → _isAllowed() in system + agent (v1.34.0)
WebTigers Oct 21, 2026
185bdbb
ci: re-trigger (unit 8.3 runner stall)
WebTigers Oct 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,14 @@ All notable changes to **Tiger Core** (`webtigers/tiger-core`). Format follows

## [Unreleased]

## [1.34.0] — 2026-10-21

### Changed
- **TIGER-335 migration (batch 3)** — `_isAdmin()` → `_isAllowed('<method>')` across **system**
(TIGER-336, 8 services incl. the Modules superadmin surface + the Sites datatable flag) and **agent**
(TIGER-338, incl. `_isAllowed('send', Tiger_Agent::RESOURCE_CHAT)`). Behavior-preserving; all services
are wildcard-privilege grants to their role (admin/superadmin/manager).

## [1.33.0] — 2026-10-21

### Changed
Expand Down
2 changes: 1 addition & 1 deletion library/Tiger/Version.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,5 +9,5 @@
class Tiger_Version
{
/** Current Tiger Core version. Keep in lockstep with the git tag cut for a release. */
const VERSION = '1.33.0';
const VERSION = '1.34.0';
}
2 changes: 1 addition & 1 deletion modules/agent/services/Agent.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -257,7 +257,7 @@ public function history(array $params): void
/** The agent must be enabled, connected, and the caller allowed. */
protected function _ready(): bool
{
if (!$this->_isAdmin(Tiger_Agent::RESOURCE_CHAT, 'send')) {
if (!$this->_isAllowed('send', Tiger_Agent::RESOURCE_CHAT)) {
$this->_error('core.api.error.not_allowed');
return false;
}
Expand Down
6 changes: 3 additions & 3 deletions modules/agent/services/Agents.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@ private function _scope(): string
*/
public function list(array $params): void
{
if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
if (!$this->_isAllowed('list')) { $this->_error('core.api.error.not_allowed'); return; }

$agents = [];
foreach ((new Tiger_Model_Agent())->allForOrg($this->_scope()) as $row) {
Expand All @@ -51,7 +51,7 @@ public function list(array $params): void
*/
public function save(array $params): void
{
if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
if (!$this->_isAllowed('save')) { $this->_error('core.api.error.not_allowed'); return; }

$form = new Agent_Form_Agent();
if (!$form->isValid($params)) { $this->_formErrors($form); return; }
Expand Down Expand Up @@ -123,7 +123,7 @@ public function save(array $params): void
*/
public function delete(array $params): void
{
if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
if (!$this->_isAllowed('delete')) { $this->_error('core.api.error.not_allowed'); return; }

$scope = $this->_scope();
$model = new Tiger_Model_Agent();
Expand Down
8 changes: 4 additions & 4 deletions modules/agent/services/Mcp.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,14 +15,14 @@ class Agent_Service_Mcp extends Tiger_Service_Service
/** The configured connections (token replaced by a has_token flag). */
public function connections(array $params): void
{
if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
if (!$this->_isAllowed('connections')) { $this->_error('core.api.error.not_allowed'); return; }
$this->_success(['connections' => Tiger_Agent_Mcp::forAdmin()]);
}

/** Create or update a connection (a blank token keeps the existing one). */
public function save(array $params): void
{
if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
if (!$this->_isAllowed('save')) { $this->_error('core.api.error.not_allowed'); return; }
$url = trim((string) ($params['url'] ?? ''));
if (!preg_match('#^https?://#i', $url)) { $this->_error('agent.mcp.bad_url'); return; }
$label = trim((string) ($params['label'] ?? ''));
Expand All @@ -46,15 +46,15 @@ public function save(array $params): void
/** Remove a connection. */
public function remove(array $params): void
{
if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
if (!$this->_isAllowed('remove')) { $this->_error('core.api.error.not_allowed'); return; }
Tiger_Agent_Mcp::remove((string) ($params['id'] ?? ''));
$this->_success(['connections' => Tiger_Agent_Mcp::forAdmin()], 'agent.mcp.removed');
}

/** Test a connection — list its tools live. */
public function test(array $params): void
{
if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
if (!$this->_isAllowed('test')) { $this->_error('core.api.error.not_allowed'); return; }
$conn = Tiger_Agent_Mcp::connection((string) ($params['id'] ?? ''));
if ($conn === null) { $this->_error('agent.mcp.not_found'); return; }

Expand Down
6 changes: 3 additions & 3 deletions modules/agent/services/Settings.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ class Agent_Service_Settings extends Tiger_Service_Service
*/
public function save(array $params): void
{
if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
if (!$this->_isAllowed('save')) { $this->_error('core.api.error.not_allowed'); return; }

$form = new Agent_Form_Settings();
if (!$form->isValid($params)) { $this->_formErrors($form); return; }
Expand Down Expand Up @@ -74,7 +74,7 @@ public function save(array $params): void
*/
public function mode(array $params): void
{
if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
if (!$this->_isAllowed('mode')) { $this->_error('core.api.error.not_allowed'); return; }

$modeMax = (string) ($params['mode_max'] ?? '');
if (!isset(Tiger_Agent::MODES[$modeMax])) { $modeMax = 'auto'; }
Expand All @@ -101,7 +101,7 @@ public function mode(array $params): void
*/
public function models(array $params): void
{
if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
if (!$this->_isAllowed('models')) { $this->_error('core.api.error.not_allowed'); return; }

$provider = preg_replace('/[^a-z]/', '', strtolower((string) ($params['provider'] ?? 'anthropic')));
if (!array_key_exists($provider, Tiger_Agent_Provider_Factory::options())) {
Expand Down
14 changes: 7 additions & 7 deletions modules/agent/services/Skills.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ class Agent_Service_Skills extends Tiger_Service_Service
*/
public function search(array $params): void
{
if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
if (!$this->_isAllowed('search')) { $this->_error('core.api.error.not_allowed'); return; }
$installed = [];
foreach (Tiger_Agent_Skills::installed() as $s) { $installed[$s['key']] = true; }

Expand All @@ -45,7 +45,7 @@ public function search(array $params): void
/** Installed skills + their active state (drives the "Installed" list). */
public function installed(array $params): void
{
if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
if (!$this->_isAllowed('installed')) { $this->_error('core.api.error.not_allowed'); return; }
$this->_success(['skills' => Tiger_Agent_Skills::installed()], null);
}

Expand All @@ -61,7 +61,7 @@ public function installed(array $params): void
*/
public function datatable(array $params): void
{
if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
if (!$this->_isAllowed('datatable')) { $this->_error('core.api.error.not_allowed'); return; }

$dt = $this->_dtParams($params);
$search = strtolower(trim((string) $dt['search']));
Expand Down Expand Up @@ -146,7 +146,7 @@ private function _row($key, $source, $name, $desc, $sourceLabel, $repo, $ref, $p
*/
public function install(array $params): void
{
if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
if (!$this->_isAllowed('install')) { $this->_error('core.api.error.not_allowed'); return; }
try {
$keys = [];
if (!empty($params['url'])) {
Expand Down Expand Up @@ -176,7 +176,7 @@ public function install(array $params): void
/** Turn an installed skill on/off. */
public function toggle(array $params): void
{
if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
if (!$this->_isAllowed('toggle')) { $this->_error('core.api.error.not_allowed'); return; }
$key = (string) ($params['key'] ?? '');
if ($key === '' || !Tiger_Agent_Skills::isInstalled($key)) { $this->_error('core.api.error.general'); return; }
$on = !empty($params['active']) && $params['active'] !== '0' && $params['active'] !== 'false';
Expand All @@ -187,7 +187,7 @@ public function toggle(array $params): void
/** Uninstall a skill (files + active set). */
public function remove(array $params): void
{
if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
if (!$this->_isAllowed('remove')) { $this->_error('core.api.error.not_allowed'); return; }
$key = (string) ($params['key'] ?? '');
if ($key === '' || !Tiger_Agent_Skills::isInstalled($key)) { $this->_error('core.api.error.general'); return; }
Tiger_Agent_Skills::remove($key);
Expand All @@ -203,7 +203,7 @@ public function remove(array $params): void
*/
public function source(array $params): void
{
if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
if (!$this->_isAllowed('source')) { $this->_error('core.api.error.not_allowed'); return; }
$key = (string) ($params['key'] ?? '');
if ($key !== '' && Tiger_Agent_Skills::isInstalled($key)) {
$this->_success(['source' => Tiger_Agent_Skills::body($key)], null);
Expand Down
4 changes: 2 additions & 2 deletions modules/system/services/Acl.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ class System_Service_Acl extends Tiger_Service_Service
*/
public function simulate(array $params): void
{
if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
if (!$this->_isAllowed('simulate')) { $this->_error('core.api.error.not_allowed'); return; }
$acl = $this->_acl();
if (!$acl) { $this->_error('system.acl.unavailable'); return; }

Expand All @@ -37,7 +37,7 @@ public function simulate(array $params): void
*/
public function catalog(array $params): void
{
if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
if (!$this->_isAllowed('catalog')) { $this->_error('core.api.error.not_allowed'); return; }
$acl = $this->_acl();
if (!$acl) { $this->_error('system.acl.unavailable'); return; }

Expand Down
6 changes: 3 additions & 3 deletions modules/system/services/Dashboard.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ class System_Service_Dashboard extends Tiger_Service_Service
*/
public function saveLayout(array $params): void
{
if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
if (!$this->_isAllowed('saveLayout')) { $this->_error('core.api.error.not_allowed'); return; }

$uid = $this->_uid();
if ($uid === '') { $this->_error('core.api.error.not_allowed'); return; }
Expand Down Expand Up @@ -70,7 +70,7 @@ public function saveLayout(array $params): void
*/
public function saveWidgetPrefs(array $params): void
{
if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
if (!$this->_isAllowed('saveWidgetPrefs')) { $this->_error('core.api.error.not_allowed'); return; }

$uid = $this->_uid();
if ($uid === '') { $this->_error('core.api.error.not_allowed'); return; }
Expand Down Expand Up @@ -107,7 +107,7 @@ public function saveWidgetPrefs(array $params): void
*/
public function widgetBody(array $params): void
{
if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
if (!$this->_isAllowed('widgetBody')) { $this->_error('core.api.error.not_allowed'); return; }

$id = (string) ($params['id'] ?? '');
foreach (Tiger_Dashboard::allowed() as $w) {
Expand Down
2 changes: 1 addition & 1 deletion modules/system/services/Logs.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ class System_Service_Logs extends Tiger_Service_Service
*/
public function search(array $params): void
{
if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; } // defense-in-depth; acl.ini gates to superadmin
if (!$this->_isAllowed('search')) { $this->_error('core.api.error.not_allowed'); return; } // defense-in-depth; acl.ini gates to superadmin

$cfg = Zend_Registry::get('Zend_Config');
$logCfg = ($cfg->tiger && $cfg->tiger->log) ? $cfg->tiger->log : null;
Expand Down
Loading
Loading