Why this fork exists

This patch addresses two issues in the Wiki.js permission system.

Page tree does not resolve TAG or REGEX rules

The tree resolver passes only path and locale to checkAccess(), so TAG and REGEX page rules have no effect on sidebar navigation. Pages that should be hidden or visible based on their tags appear incorrectly in the tree.

The resolver was adapted to fetch each page's tags from the pageTags database table and include them in the access check alongside path and locale. This allows TAG and REGEX rules to filter tree items correctly.

Folder nodes have no associated page record (no pageId) and therefore carry no tags. To handle this, folders that are denied by the initial access check are kept visible when at least one descendant page passes the full access check (including TAG and REGEX), so the user can still navigate to those pages. This adds at most two extra database queries and only runs when folders are denied.

Rule specificity resolution is string length based

The upstream specificity resolution is path-length based, which is adequate for START and END rules but does not properly rank TAG and REGEX rules. The new algorithm assigns fixed priorities to non-path-based rules:

1. EXACT — highest priority (MAX_SAFE_INTEGER). Matches when the page path is identical to the rule path.
2. TAG — (MAX_SAFE_INTEGER - 1). Matches when any of the page's tags equals the rule value.
3. REGEX — (MAX_SAFE_INTEGER - 2). Matches when the page path satisfies the rule's regular expression.
4. END — path-length based (segments + separators + 0.5). Matches when the page path ends with the rule path.
5. START — path-length based (segments + separators). Matches when the page path starts with the rule path. Lowest priority.

Deny still takes precedence over Allow at the same specificity level.

The admin group rules editor component was also updated to properly support all five match types in the UI.

CI/CD pipeline (fork-only)

The GitHub Actions workflow was adapted for the fork. These changes are not part of the upstream PR:

• Publishes container images to ghcr.io/alacrity-education/wikijs instead of DockerHub.
• Removed the Windows build job (Linux and ARM64 only).
• Made Cypress test recording conditional on the CYPRESS_KEY secret, so CI succeeds without a Cypress Dashboard subscription.
• Removed the third-party changelog generation step that required conventional commit format.

Branch structure

• main contains all fork changes (code fixes, CI adaptations, README).
• fix-permissions-upstream isolates only the code changes rebased on top of upstream main, used for the upstream PR.