Rename table full access label and use action like for table:*

- Rename "Full access" to "Full table access" for table:* action
- Generate single permit with action like RocketAdmin::Action::"table:*"
- Fix duplicate action == in permit template
- Parser handles table:* action and action like operator

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: gugu

frontend/src/app/components/users/cedar-policy-list/cedar-policy-list.component.spec.ts

@@ -119,7 +119,7 @@ describe('CedarPolicyListComponent', () => {
 		expect(component.getActionLabel('*')).toBe('Full access (all permissions)');
 		expect(component.getActionLabel('connection:read')).toBe('Read');
 		expect(component.getActionLabel('table:edit')).toBe('Edit');
-		expect(component.getActionLabel('table:*')).toBe('Full access');
+		expect(component.getActionLabel('table:*')).toBe('Full table access');
 	});
 
 	it('should return correct table display names', () => {

frontend/src/app/lib/cedar-policy-items.ts

@@ -38,7 +38,7 @@ export const POLICY_ACTION_GROUPS: PolicyActionGroup[] = [
 	{
 		group: 'Table',
 		actions: [
-			{ value: 'table:*', label: 'Full access', needsTable: true },
+			{ value: 'table:*', label: 'Full table access', needsTable: true },
 			{ value: 'table:read', label: 'Read', needsTable: true },
 			{ value: 'table:add', label: 'Add', needsTable: true },
 			{ value: 'table:edit', label: 'Edit', needsTable: true },
@@ -120,20 +120,10 @@ export function policyItemsToCedarPolicy(items: CedarPolicyItem[], connectionId:
 			return policies.join('\n\n');
 		}
 
-		// table:* expands to 4 individual table action permits
-		if (item.action === 'table:*') {
-			const tableResource =
-				item.tableName === '*'
-					? `resource like RocketAdmin::Table::"${connectionId}/*"`
-					: `resource == RocketAdmin::Table::"${connectionId}/${item.tableName}"`;
-			for (const subAction of ['table:read', 'table:add', 'table:edit', 'table:delete']) {
-				const ref = `RocketAdmin::Action::"${subAction}"`;
-				policies.push(`permit(\n  principal,\n  action == ${ref},\n  ${tableResource}\n);`);
-			}
-			continue;
-		}
-
-		const actionRef = `RocketAdmin::Action::"${item.action}"`;
+		const actionRef =
+			item.action === 'table:*'
+				? `action like RocketAdmin::Action::"table:*"`
+				: `action == RocketAdmin::Action::"${item.action}"`;
 		let resource: string;
 
 		if (item.action.startsWith('table:')) {
@@ -148,7 +138,7 @@ export function policyItemsToCedarPolicy(items: CedarPolicyItem[], connectionId:
 			resource = `resource == RocketAdmin::Connection::"${connectionId}"`;
 		}
 
-		policies.push(`permit(\n  principal,\n  action == ${actionRef},\n  ${resource}\n);`);
+		policies.push(`permit(\n  principal,\n  ${actionRef},\n  ${resource}\n);`);
 	}
 
 	return policies.join('\n\n');

frontend/src/app/lib/cedar-policy-parser.ts

@@ -51,6 +51,7 @@ export function parseCedarPolicy(
 			case 'group:edit':
 				result.group.accessLevel = AccessLevel.Edit;
 				break;
+			case 'table:*':
 			case 'table:read':
 			case 'table:add':
 			case 'table:edit':
@@ -176,7 +177,7 @@ function parsePermitBody(body: string): ParsedPermitStatement {
 		isWildcard: false,
 	};
 
-	const actionMatch = body.match(/action\s*==\s*RocketAdmin::Action::"([^"]+)"/);
+	const actionMatch = body.match(/action\s*(?:==|like)\s*RocketAdmin::Action::"([^"]+)"/);
 	if (actionMatch) {
 		result.action = actionMatch[1];
 	} else {
@@ -230,6 +231,13 @@ function getOrCreateTableEntry(map: Map<string, TablePermission>, tableName: str
 
 function applyTableAction(entry: TablePermission, action: string): void {
 	switch (action) {
+		case 'table:*':
+			entry.accessLevel.visibility = true;
+			entry.accessLevel.readonly = true;
+			entry.accessLevel.add = true;
+			entry.accessLevel.edit = true;
+			entry.accessLevel.delete = true;
+			break;
 		case 'table:read':
 			entry.accessLevel.visibility = true;
 			entry.accessLevel.readonly = true;