mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
28475455db
Nine roles reached their MCP surface as the deployment administrator or with an account password kept beside the account in credentials. A Moodle site admin bypasses every capability check, a Nextcloud app password is not scopable, a Gitea token reads every private repository, and a GitLab token on root reads every private project. Each role now declares its own principal in meta/users.yml and provisions it, so the exposed surface is what the service role permits. jellyfin, zammad and snipe-it kept their account but took its password from a credential named token; they read the registry too. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
23 lines
656 B
YAML
23 lines
656 B
YAML
---
|
|
administrator: {}
|
|
helpdesk:
|
|
roles:
|
|
- bot
|
|
zammad-api-bot:
|
|
username: zammad-api-bot
|
|
firstname: Infinito
|
|
lastname: API Bot
|
|
accounts: []
|
|
description: API-only Basic-auth bot used by the Playwright suite (NOT an OIDC user)
|
|
zammad-wizard-bypass-admin:
|
|
username: wizard-bypass-admin
|
|
firstname: Wizard
|
|
lastname: Bypass
|
|
accounts: []
|
|
description: Local-password admin seeded by Zammad's auto_wizard.json to skip the setup wizard (NOT used at runtime)
|
|
mcp-web-app-zammad:
|
|
firstname: Infinito
|
|
lastname: MCP
|
|
accounts: []
|
|
description: Account the Zammad MCP token belongs to; a read-only agent rather than the initial administrator
|