# INP2P Tenant RBAC Matrix

## Access Context

- `session/admin`：租户管理员
- `session/operator`：租户操作员
- `apikey`：租户 API key（机器访问）
- `master`：系统级 token（禁止用于 tenant API）

## Action Mapping

| action | session/admin | session/operator | apikey |
|---|---:|---:|---:|
| `view` | ✅ | ✅ | ✅ |
| `mutate_node_meta` (alias/ip) | ✅ | ✅ | ❌ |
| `mutate_sdwan` | ✅ | ✅ | ❌ |
| `mutate_connect` | ✅ | ✅ | ❌ |
| `mutate_node_control` (apps push / kick) | ✅ | ✅ | ❌ |
| `enroll_manage` (revoke enroll token) | ✅ | ❌ | ❌ |

## Route Coverage (implemented)

- `POST /api/v1/nodes/alias` -> `mutate_node_meta`
- `POST /api/v1/nodes/ip` -> `mutate_node_meta`
- `POST /api/v1/sdwan/edit` -> `mutate_sdwan`
- `POST /api/v1/connect` -> `mutate_connect`
- `POST /api/v1/nodes/apps` -> `mutate_node_control`
- `POST /api/v1/nodes/kick` -> `mutate_node_control`
- `POST /api/v1/enroll/consume/{id}?status=0|1` -> `enroll_manage`

## Security Notes

- `master` token is blocked by tenant middleware.
- Enroll revoke path now requires tenant auth and `session/admin`.
- WS login logs no longer print raw token values.