Add Configuration Actions tab for shell and script action definitions.

Admins can manage built-in and custom actions with placeholders, ENV vars, and actions.create/update/delete permissions.

service/internal/api/authz.go

@@ -11,6 +11,9 @@ var errUsersManageRequired = errors.New("permission users.manage required")
 var errNodesReadRequired = errors.New("permission nodes.read required")
 var errNodesExecRequired = errors.New("permission nodes.exec required")
 var errNodesDeleteRequired = errors.New("permission nodes.delete required")
+var errActionsCreateRequired = errors.New("permission actions.create required")
+var errActionsUpdateRequired = errors.New("permission actions.update required")
+var errActionsDeleteRequired = errors.New("permission actions.delete required")
 
 // permissionsForUser returns the union of permissions from the user's groups.
 func permissionsForUser(user settings.UserCredential, groups []settings.Group) map[string]struct{} {
@@ -49,6 +52,22 @@ func permissionList(user settings.UserCredential, groups []settings.Group) []str
 	return result
 }
 
+func authorizeNamedPermission(request *http.Request, configDir string, permission string, missing error) error {
+	user, ok := UserFromContext(request.Context())
+	if !ok {
+		return errors.New("authentication required")
+	}
+
+	payload, err := loadSettingsOrDefault(configDir)
+	if err != nil {
+		return err
+	}
+	if !userHasPermission(user, payload.Groups, permission) {
+		return missing
+	}
+	return nil
+}
+
 func (app *App) authorizeUsersWrite(request *http.Request) error {
 	user, ok := UserFromContext(request.Context())
 	if !ok {
@@ -112,3 +131,15 @@ func (app *App) authorizeNodesDelete(request *http.Request) error {
 	}
 	return nil
 }
+
+func authorizeActionsCreate(request *http.Request, configDir string) error {
+	return authorizeNamedPermission(request, configDir, "actions.create", errActionsCreateRequired)
+}
+
+func authorizeActionsUpdate(request *http.Request, configDir string) error {
+	return authorizeNamedPermission(request, configDir, "actions.update", errActionsUpdateRequired)
+}
+
+func authorizeActionsDelete(request *http.Request, configDir string) error {
+	return authorizeNamedPermission(request, configDir, "actions.delete", errActionsDeleteRequired)
+}