partial implement (Save)

backend/internal/graph/schema.graphql

@@ -38,11 +38,17 @@ type Query {
   # Fetch permissions for a path
   acl(path: String!): [ACLEntry!]!
 
+  # Fetch all permissions for a specific user or group (admin only).
+  subjectAcl(subjectType: String!, subjectId: Int!): [ACLEntry!]!
+
   # Returns all users and groups that can be assigned to ACL entries (admin only).
   aclSubjects: ACLSubjects!
 
   # Returns "local", "ldap", or "guest" for a given username.
   userAuthType(username: String!): String!
+
+  # Returns the role of the currently authenticated user ("admin", "user", "guest").
+  currentUserRole: String!
 }
 
 type Mutation {

backend/internal/graph/server.go

@@ -212,9 +212,15 @@ func (s *Server) dispatchAuthenticated(
 	case strings.Contains(q, "ldapBrowse"):
 		s.handleLdapBrowse(w, req, sess)
 
+	case strings.Contains(q, "aclSubjects"):
+		s.handleAclSubjects(w, sess)
+
 	case strings.Contains(q, "users"):
 		s.handleUsers(w, sess)
 
+	case strings.Contains(q, "currentUserRole"):
+		s.handleCurrentUserRole(w, sess)
+
 	case strings.Contains(q, "updateStoragePath"):
 		s.handleUpdateStoragePath(w, req, sess)
 
@@ -248,6 +254,9 @@ func (s *Server) dispatchAuthenticated(
 	case strings.Contains(q, "aclSubjects"):
 		s.handleAclSubjects(w, sess)
 
+	case strings.Contains(q, "subjectAcl"):
+		s.handleSubjectAcl(w, req, sess)
+
 	case strings.Contains(q, "acl(") || strings.Contains(q, "acl "):
 		s.handleAcl(w, req, sess)
 
@@ -709,6 +718,66 @@ func (s *Server) handleUsers(w http.ResponseWriter, sess *auth.Session) {
 	})
 }
 
+func (s *Server) handleSubjectAcl(w http.ResponseWriter, req gqlRequest, sess *auth.Session) {
+	if sess == nil || sess.Role != "admin" {
+		writeGQLError(w, "UNAUTHORIZED")
+		return
+	}
+
+	subjectType := strVal(req.Variables, "subjectType")
+	subjectIDf, ok := req.Variables["subjectId"].(float64)
+	if !ok || subjectType == "" {
+		writeGQLError(w, "Missing subjectType or subjectId")
+		return
+	}
+
+	s.mu.RLock()
+	database := s.database
+	s.mu.RUnlock()
+
+	acls, err := database.GetACLsForSubject(subjectType, int64(subjectIDf))
+	if err != nil {
+		writeGQLError(w, err.Error())
+		return
+	}
+
+	var aclData []map[string]interface{}
+	for _, a := range acls {
+		aclData = append(aclData, map[string]interface{}{
+			"id":          a.ID,
+			"path":        a.Path,
+			"subjectType": a.SubjectType,
+			"subjectId":   a.SubjectID,
+			"canSearch":   a.CanSearch,
+			"canView":     a.CanView,
+			"canRead":     a.CanRead,
+			"canEdit":     a.CanEdit,
+			"canCreate":   a.CanCreate,
+			"canDelete":   a.CanDelete,
+			"canMove":     a.CanMove,
+		})
+	}
+	if aclData == nil {
+		aclData = []map[string]interface{}{}
+	}
+
+	writeJSONObj(w, map[string]interface{}{
+		"data": map[string]interface{}{"subjectAcl": aclData},
+	})
+}
+
+func (s *Server) handleCurrentUserRole(w http.ResponseWriter, sess *auth.Session) {
+	if sess == nil {
+		writeGQLError(w, "UNAUTHORIZED")
+		return
+	}
+	writeJSONObj(w, map[string]interface{}{
+		"data": map[string]interface{}{
+			"currentUserRole": sess.Role,
+		},
+	})
+}
+
 func (s *Server) handleAclSubjects(w http.ResponseWriter, sess *auth.Session) {
 	if sess == nil || sess.Role != "admin" {
 		writeGQLError(w, "UNAUTHORIZED")