Implemented admin pane + user permission

uopi.example.toml

@@ -11,23 +11,33 @@ trusted_user_header = ""        # e.g. "X-Forwarded-User"
 # Identity used when the trusted header is absent/empty. Empty = anonymous.
 default_user        = ""
 
-# Every user is trusted with full write access by default. The blacklist
-# downgrades specific users. Levels: "readonly" (view only, no writes) or
-# "noaccess" (denied entirely).
-# [[server.blacklist]]
-# user  = "guest"
-# level = "readonly"
-
-# Named sets of users, referenced by per-panel sharing rules.
+# Role-based access through group memberships. Each [[groups]] block lists
+# members by role; a user's effective global capability is the highest role
+# across all their memberships, along this ladder:
+#   viewer < operator < logiceditor < auditor < admin
+# Capabilities: operator+ may write signals; logiceditor+ may edit panel and
+# control logic; auditor+ may view the audit log; admin may open the admin pane.
+#
+# The built-in "public" group is implicit (every user is a viewer of it). A
+# config with NO roles assigned anywhere is fully open (everyone is admin), for
+# trusted-LAN/dev use; assigning any role switches to strict mode where unlisted
+# users are read-only viewers. Once changed at runtime via the admin pane,
+# {storage_dir}/access.json supersedes the groups below.
+#
+# Groups may nest via "parent": a member of a parent group inherits its role on
+# every descendant group too (unless overridden lower).
 # [[groups]]
-# name    = "operators"
-# members = ["alice", "bob"]
-
-# Optional: restrict who may add or edit panel logic (the <logic> block of
-# interfaces) AND server-side control logic. Entries are usernames or group
-# names. Empty/unset = no restriction (any writer may edit logic). Also settable
-# via UOPI_SERVER_LOGIC_EDITORS (space-separated).
-# logic_editors = ["operators", "alice"]
+# name   = "public"
+# admins = ["alice"]          # alice is a global admin
+# [[groups]]
+# name         = "operations"
+# operators    = ["bob"]
+# auditors     = ["carol"]
+# [[groups]]
+# name         = "engineers"
+# parent       = "operations" # bob inherits operator here
+# logiceditors = ["dave"]
+# viewers      = ["erin"]
 
 [datasource.epics]
 enabled            = true