[mineiwik]

Grants came up in #607. Auto approvers overlap with #550, which was written against the earlier editor.

[pullfrog]

ℹ️ No critical issues — two minor suggestions inline.

Reviewed changes — Grants and auto approvers are now editable in the ACL Rules tab.

• Grants model and editor — Policy gains grants: Grant[] and a new GrantDialog; ports/protocols live in ip, app capabilities ride along in extra, and compactGrant omits an empty ip.
• Auto approvers model and editor — autoApprovers becomes { routes, exitNode, extra } with a new AutoApproverDialog covering create, rename, and delete for route and exit-node entries.
• Parse/serialize — grants and autoApprovers move out of extra into KNOWN_KEYS, with round-trip and empty-section handling plus the new isValidRoute validator.
• Docs and changelog — ACL docs updated to five lists; CHANGELOG entry added.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes — incremental re-review of the fix commit ae279f3, which addresses both findings from the prior review (07c6c22).

• App-only grants no longer render a dangling on label — the on text and ip chips are now rendered only when entry.ip.length > 0, so a grant carrying just app capabilities lists cleanly.
• isValidRoute now bounds IPv6 prefixes and validates IPv4 octets — IPv6 prefixes above /128 are rejected (fd7a::/129, fd7a::/999), and IPv4 addresses with an octet above 255 (10.0.0.999/8) are rejected, matching the existing /33 case; tests were added for all three.

The validator fix reads correctly: the IPv4 branch caps the prefix at /32 and range-checks each octet, and the IPv6 branch keeps the length bound in isValidRoute since isIpv6 is documented as a loose alias check. Both prior review threads are resolved.

  ^{｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

ℹ️ No critical issues — one minor documentation suggestion inline.

Reviewed changes — incremental re-review of 54cd79d, which adds via tag support to grants on top of the two findings already resolved in earlier passes.

• Grant via support — Grant gains via: string[], GRANT_KEYS includes it, toGrants/compactGrant round-trip it (empty via omitted), the grant dialog adds a tag-validated Via chip list, and grant rows render via chips.
• Tests and docs — a via round-trip test was added, and the ACL docs and CHANGELOG mention via.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes — incremental re-review of 4ed9be0, which gates grants editing and saving on Headscale 0.29 or newer.

• Version capability — Added policySupportsGrants (gte(version, "0.29.0")) to Capabilities.
• Server-side refusal — The ACL save action parses the submitted policy and throws a clear ActionError when grants is present on an older server, instead of surfacing Headscale's bare unknown field "grants".
• UI gating — The loader exposes canEditGrants and the Rules tab hides the Grants section when the capability is off.
• Docs and changelog — The version requirement is documented through versions.headscale.grants and the CHANGELOG entry.
• Tests — The integration test covers save-or-refuse per version, and the contract test asserts grants are accepted on 0.29 while 0.27/0.28 reject them with unknown field "grants".

  ^{｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[mineiwik]

@tale Thank you!