Release v2.17.1: remove obsolete dashboard permission

CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to this project will be documented in this file.
 
+## 2.17.1 - 2026-10-23
+
+### Fixed
+
+- Removed the obsolete `dashboard.allow` permission and its role assignments from existing databases so it no longer appears in role permissions.
+
 ## 2.17.0 - 2026-10-23
 
 ### Added

build/package.player.json

@@ -1,6 +1,6 @@
 {
   "name": "pulse-signage-player",
-  "version": "2.17.0",
+  "version": "2.17.1",
   "private": false,
   "description": "Pulse Signage player application bundle",
   "engines": {

build/package.web.json

@@ -1,6 +1,6 @@
 {
   "name": "pulse-signage-web",
-  "version": "2.17.0",
+  "version": "2.17.1",
   "private": false,
   "description": "Pulse Signage web and bridge application bundle",
   "engines": {

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "pulse-signage",
-  "version": "2.17.0",
+  "version": "2.17.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "pulse-signage",
-      "version": "2.17.0",
+      "version": "2.17.1",
       "dependencies": {
         "animate.css": "^4.1.1",
         "bootstrap-icons": "1.13.1",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "pulse-signage",
-  "version": "2.17.0",
+  "version": "2.17.1",
   "private": false,
   "description": "Pulse Signage application with MySQL and media storage",
   "engines": {

src/db/migrations.js

@@ -732,6 +732,20 @@ const VERSIONED_MIGRATIONS = [
       await ensureColumn(pool, 'a_sessions', 'view_as_user_id', 'INT NULL', 'user_id');
       await ensureColumn(pool, 'a_sessions', 'view_as_expires_at', 'DATETIME NULL', 'view_as_user_id');
     }
+  },
+  {
+    version: '2.17.1',
+    label: 'v2.17.1 remove obsolete dashboard permission',
+    run: async function (pool) {
+      await pool.query(
+        `DELETE role_permissions
+           FROM a_role_permissions role_permissions
+           JOIN a_permissions permissions ON permissions.id = role_permissions.permission_id
+          WHERE permissions.permission_key = ?`,
+        ['dashboard.allow']
+      );
+      await pool.query('DELETE FROM a_permissions WHERE permission_key = ?', ['dashboard.allow']);
+    }
   }
 ];
 

test/timetable-migrations.test.js

@@ -161,7 +161,7 @@ test('2.17.0 migration adds the expiring view-as session columns', async () => {
   ]);
 
   const pending = await getPendingMigrations(pool, { currentVersion: '2.16.2' });
-  assert.deepEqual(pending.map(function (migration) { return migration.version; }), ['2.17.0']);
+  assert.deepEqual(pending.map(function (migration) { return migration.version; }), ['2.17.0', '2.17.1']);
   await pending[0].run(pool);
 
   assert.ok(pool.queries.some(function ([sql]) {
@@ -171,3 +171,31 @@ test('2.17.0 migration adds the expiring view-as session columns', async () => {
     return String(sql).includes('ALTER TABLE a_sessions ADD COLUMN view_as_expires_at DATETIME NULL AFTER view_as_user_id');
   }));
 });
+
+test('2.17.1 migration removes obsolete dashboard.allow grants and permission', async () => {
+  const pool = createPool([
+    {
+      match(sql) {
+        return sql.includes('FROM information_schema.COLUMNS');
+      },
+      result: [[{ column_count: 1 }]]
+    },
+    {
+      match(sql) {
+        return sql.includes('FROM information_schema.TABLES');
+      },
+      result: [[{ table_count: 0 }]]
+    }
+  ]);
+
+  const pending = await getPendingMigrations(pool, { currentVersion: '2.17.0' });
+  assert.deepEqual(pending.map(function (migration) { return migration.version; }), ['2.17.1']);
+  await pending[0].run(pool);
+
+  assert.ok(pool.queries.some(function ([sql, params]) {
+    return String(sql).includes('DELETE role_permissions') && params[0] === 'dashboard.allow';
+  }));
+  assert.ok(pool.queries.some(function ([sql, params]) {
+    return String(sql).includes('DELETE FROM a_permissions') && params[0] === 'dashboard.allow';
+  }));
+});