aiolabs/payroll
9
0
Fork 0
Code Issues 6 Pull requests Projects Releases Packages Wiki Activity Actions

docs: correct how the employee payslip surface is gated

Browse source 
The README and operations notes claimed the /my/* endpoints "stay reachable
regardless of LNBITS_ADMIN_EXTENSIONS" because "the API routes are mounted
instance-wide". Both halves are wrong, and the smoke test on bohm caught it:
an invoice-key request from employee_1 came back with

    {"detail": "Extension 'payroll' not enabled."}

LNbits gates every extension path per user via check_user_extension_access
(lnbits/decorators.py:420), not just the UI listing. Two consequences the
docs now state instead of contradicting:

- An employee needs `payroll` among their active extensions before an
  invoice key gets them anywhere. Enable it through
  LNBITS_USER_DEFAULT_EXTENSIONS or per account in the Admin UI.
- `payroll` must stay OUT of LNBITS_ADMIN_EXTENSIONS. That list trips the
  earlier branch of the same check — "User not authorized for extension" —
  which a non-admin can never clear, so it would permanently lock employees
  out of their own payslips. It also buys nothing: check_super_user on the
  router and user.super_user on the page route are what actually restrict
  the console, and a non-admin key was verified to get 401 from
  /contracts and /users.

Also notes the wart this exposes: an employee with the extension enabled
sees "Payroll" in their menu and gets a 403 page, because the only page
route is the operator console. Filed as a follow-up rather than fixed here.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018jy52j9GRZ6XKa1Zt21LLj
This commit is contained in:
Padreug 2026-08-31 16:16:19 +02:00
commit 36e1643470
2 changed files with 44 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

21
docs/operations.md
View file

@ -160,7 +160,20 @@ Scoped to the wallet rather than to the account on purpose: an invoice key
names exactly one wallet, so there is no lookup that could widen the result
to a sibling wallet the key does not cover.
Note this stays reachable even with `payroll` in `LNBITS_ADMIN_EXTENSIONS`.
That flag governs who sees the extension in the UI; the API routes are
mounted instance-wide, and these three are gated by the wallet key they
require rather than by UI visibility.
**The employee must also have `payroll` enabled on their account.** LNbits
gates extension routes per user, not just the UI — `_check_user_access`
runs `check_user_extension_access` (`lnbits/decorators.py:420`) on every
extension path. Without it the endpoint answers `{"detail": "Extension
'payroll' not enabled."}` however valid the invoice key is. Enable it via
`LNBITS_USER_DEFAULT_EXTENSIONS` or per account in the Admin UI.
For the same reason `payroll` must stay **out** of
`LNBITS_ADMIN_EXTENSIONS`: that list trips the earlier branch of the same
check, *"User not authorized for extension"*, which a non-admin can never
clear. It would lock employees out of their own payslips permanently, and
it buys nothing — the operator console is already gated in code by
`check_super_user` on the router and `user.super_user` on the page route.
Known wart: an employee with the extension enabled sees "Payroll" in their
menu, and clicking it hits the operator console route, which 403s. Tracked
as a follow-up — the page should render their payslips instead.