From 4701369cc2f1e91ce562aff51b172d9543c49a8f Mon Sep 17 00:00:00 2001
From: Brandon Corbett <Bccorb@users.noreply.github.com>
Date: Fri, 6 Nov 2026 01:29:17 -0500
Subject: [PATCH 1/2] ci(conformance): hold this adapter to the permission
 guard contract

---
 .github/workflows/ci.yml | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 96824e9..08f5397 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -84,9 +84,10 @@ jobs:
       - name: Conformance
         env:
           SEAMLESS_API_DIR: ${{ github.workspace }}/seamless-auth-api
-          # This adapter ships the content-type gate, so hold it to the pending
-          # contract (seamless-cli verify/harness/lib/pendingContracts.ts).
-          SEAMLESS_VERIFY_CONTRACTS: content-type-gate
+          # This adapter ships the content-type gate and permission guards, so hold
+          # it to those pending contracts (seamless-cli
+          # verify/harness/lib/pendingContracts.ts).
+          SEAMLESS_VERIFY_CONTRACTS: content-type-gate,permission-guards
         run: node seamless-cli/dist/index.js verify --adapter-url=http://localhost:8080
       - name: Reference app log
         if: always()

From ce2f9aed97e818402fbbb00a87c7dd6abe5f8dff Mon Sep 17 00:00:00 2001
From: Brandon Corbett <Bccorb@users.noreply.github.com>
Date: Fri, 6 Nov 2026 01:30:24 -0500
Subject: [PATCH 2/2] fix(manifest): sync with the auth API routes for
 permissions

---
 src/seamless_auth/manifest.json | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/src/seamless_auth/manifest.json b/src/seamless_auth/manifest.json
index 372a6ad..68a07d0 100644
--- a/src/seamless_auth/manifest.json
+++ b/src/seamless_auth/manifest.json
@@ -35,6 +35,9 @@
     { "method": "GET", "path": "/admin/credential-count", "credential": "access" },
     { "method": "GET", "path": "/admin/enrollment", "credential": "access" },
     { "method": "POST", "path": "/admin/enrollment/invites", "credential": "access" },
+    { "method": "POST", "path": "/admin/organization-roles", "credential": "access" },
+    { "method": "DELETE", "path": "/admin/organization-roles/{roleName}", "credential": "access" },
+    { "method": "PATCH", "path": "/admin/organization-roles/{roleName}", "credential": "access" },
     { "method": "GET", "path": "/admin/organizations", "credential": "access" },
     { "method": "POST", "path": "/admin/organizations", "credential": "access" },
     { "method": "DELETE", "path": "/admin/organizations/{organizationId}", "credential": "access" },
@@ -70,6 +73,10 @@
       "path": "/admin/organizations/{organizationId}/oauth-providers/{providerId}/retirement",
       "credential": "access"
     },
+    { "method": "GET", "path": "/admin/permissions", "credential": "access" },
+    { "method": "POST", "path": "/admin/permissions", "credential": "access" },
+    { "method": "DELETE", "path": "/admin/permissions/{permissionName}", "credential": "access" },
+    { "method": "PATCH", "path": "/admin/permissions/{permissionName}", "credential": "access" },
     { "method": "GET", "path": "/admin/reports/authentication-coverage", "credential": "access" },
     { "method": "GET", "path": "/admin/resources", "credential": "access" },
     { "method": "POST", "path": "/admin/resources", "credential": "access" },
@@ -77,6 +84,12 @@
     { "method": "GET", "path": "/admin/resources/{id}", "credential": "access" },
     { "method": "PATCH", "path": "/admin/resources/{id}", "credential": "access" },
     { "method": "GET", "path": "/admin/review-accounts", "credential": "access" },
+    { "method": "GET", "path": "/admin/roles", "credential": "access" },
+    {
+      "method": "PUT",
+      "path": "/admin/roles/{kind}/{roleName}/permissions",
+      "credential": "access"
+    },
     { "method": "GET", "path": "/admin/sessions", "credential": "access" },
     { "method": "GET", "path": "/admin/sessions/{userId}", "credential": "access" },
     { "method": "DELETE", "path": "/admin/sessions/{userId}/revoke-all", "credential": "access" },
@@ -278,6 +291,7 @@
       "clears": ["access", "registration", "refresh"]
     },
     { "method": "GET", "path": "/users/me", "credential": "access", "clears": ["preAuth"] },
+    { "method": "GET", "path": "/users/me/permissions", "credential": "access" },
     {
       "method": "POST",
       "path": "/webauthn/login/finish",