Repository navigation
feat(permissions): map roles to permissions and carry them in the access token - #576
Merged
Merged
Conversation
…ess token Adds a permission catalogue and a role mapping, an audited admin API with step-up on writes, and a permissions claim on every access token, minted in one place. A set that would not fit is omitted whole, and a guard reads the live set from GET /users/me/permissions. Permissions match exactly. Records the design in ADR 0004. Closes #415.
This was referenced Nov 6, 2026
Merged
ci(conformance): hold this adapter to the permission guard contract
fells-code/seamless-auth-rust#41
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #415. Design in
docs/adr/0004-permissions-and-organization-roles.md, agreed before building. #416 is stacked on this branch. Uses@seamless-auth/types0.38.0 (fells-code/seamless-auth-types#154).What
permissionsandrole_permissionstables. Instance roles stay inavailable_roles, and removing one also deletes its mappings, so adding the name back grants nothing.GETandPOST /admin/permissions,PATCHandDELETE /admin/permissions/:permissionName,GET /admin/roles,PUT /admin/roles/:kind/:roleName/permissions. Writes needadmin:writeand step-up, and are audited. Deleting a permission a role still grants is a 409 naming the roles, and the foreign key holds the same line against a race.permissionson every access token, matched exactly with no wildcards or implied grants. Empty on a recovery session.mintAccessToken.permissions_omitted: trueinstead of a partial list, and a guard readsGET /users/me/permissions, which answers from the database.GET /users/megainsuser.permissions.For review
access_token_ttl, the same asrolestoday.billingdoes not pick up a mapping onbilling:read./admin/roleslists instance roles only, soPUT /admin/roles/organization/...answers 404 until feat: organization-scoped roles and permissions in the access token #416.issueSessionCookiesin seamless-auth-server rather than calling that code.Testing
Run locally on this branch with the published types:
postgres:18-alpine: 3,217 passed, 1 todoNot run: the conformance harness. This PR adds no adapter behavior, and the guards arrive with step 3 of Wave 3.
Release
Part of the held API v0.23.0 release. #566 stays open. Minor changeset included. New migration:
20261105120000-add-permissions.