@critical-path/client 0.15.0 → 0.15.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +26 -0
- package/package.json +3 -3
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,31 @@
|
|
|
1
1
|
# @critical-path/client
|
|
2
2
|
|
|
3
|
+
## 0.15.1
|
|
4
|
+
|
|
5
|
+
### Patch Changes
|
|
6
|
+
|
|
7
|
+
- 719e844: Role-based authorization and multi-tenancy.
|
|
8
|
+
|
|
9
|
+
**@critical-path/core**
|
|
10
|
+
- New `authorize` engine option and `createRolePolicy()`:
|
|
11
|
+
- Project roles (`viewer`, `contributor`, `project_manager`, `admin`) come from `project.members`.
|
|
12
|
+
- Workspace superusers come from `actor.roles`.
|
|
13
|
+
- Authors manage their own comments and attachments.
|
|
14
|
+
- Checks run on `withActor` views. Unreadable or cross-tenant projects behave as not found, denied actions throw the new `ForbiddenError`, and lists are filtered.
|
|
15
|
+
- `Actor` gains `tenantId` and `roles`. Projects, workflows and teams gain `tenantId`, stamped from the actor and never accepted from payloads. Reads are scoped to the actor's tenant, including the default-workflow fallback.
|
|
16
|
+
- **BREAKING:** `Project.members` is now `{ userId, role }[]` (was `string[]`). Project creators become `admin` members.
|
|
17
|
+
- New `engine.getActivities()` and `engine.getTimeEntries()`, which respect authorization.
|
|
18
|
+
- **BREAKING:** on views, presigned uploads require `projectId` and are confined to `projects/<projectId>/`. The presign request schema now requires `projectId`.
|
|
19
|
+
- `SQLiteStore` persists `tenantId` (migrated automatically).
|
|
20
|
+
|
|
21
|
+
**@critical-path/server**
|
|
22
|
+
- `RequestContext` gains `tenantId` and `roles`, which are passed to the actor. `ForbiddenError` maps to `403`. Activities and time entries are read through the engine.
|
|
23
|
+
|
|
24
|
+
**@critical-path/client / @critical-path/mcp**
|
|
25
|
+
- Rebuilt for the new presign `projectId` requirement and project member shape.
|
|
26
|
+
- Updated dependencies [719e844]
|
|
27
|
+
- @critical-path/core@0.26.0
|
|
28
|
+
|
|
3
29
|
## 0.15.0
|
|
4
30
|
|
|
5
31
|
### Minor Changes
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@critical-path/client",
|
|
3
|
-
"version": "0.15.
|
|
3
|
+
"version": "0.15.1",
|
|
4
4
|
"description": "Type-safe JavaScript/TypeScript client SDK for consuming Critical Path API endpoints",
|
|
5
5
|
"author": "Jack James",
|
|
6
6
|
"license": "MIT",
|
|
@@ -21,13 +21,13 @@
|
|
|
21
21
|
}
|
|
22
22
|
},
|
|
23
23
|
"dependencies": {
|
|
24
|
-
"@critical-path/core": "0.
|
|
24
|
+
"@critical-path/core": "0.26.0"
|
|
25
25
|
},
|
|
26
26
|
"devDependencies": {
|
|
27
27
|
"@types/node": "^24.0.0",
|
|
28
28
|
"typescript": "^5.7.0",
|
|
29
29
|
"vitest": "^3.0.0",
|
|
30
|
-
"@critical-path/server": "0.
|
|
30
|
+
"@critical-path/server": "0.18.0"
|
|
31
31
|
},
|
|
32
32
|
"engines": {
|
|
33
33
|
"node": ">=24.0.0"
|