@happyvertical/smrt-users 0.38.22 → 0.38.24

package/AGENTS.md

@@ -88,6 +88,16 @@ throw). The default seed leaves every role exact-tenant.
 
 ## Operation Permission Guards
 
+SMRT derives a fine-grained, per-`<collection>.<action>` permission catalog **from the
+manifest** (`PermissionCatalogService`, including custom `@smrt` actions — not just CRUD)
+and enforces it two ways: app-side via `assertOperationPermission()` / `PermissionResolver`,
+and at the database via generated **Postgres RLS** policies
+(`generatePostgresPermissionSql()` / `applyPostgresPermissionPolicies()`) that read the
+session-injected `smrt.permissions` / `smrt.tenant_id` (set by `withSessionPermissionContext`
+via `set_config`). Because the RLS teeth are at the data layer, enforcement is door-agnostic
+— REST, MCP, and in-process callers are all bounded once the principal's context is set.
+Setup: README → *Manifest-derived permission catalog* and *Postgres RLS enforcement*.
+
 - Use `assertOperationPermission()` for hand-written mutations in SvelteKit form
   actions, custom endpoints, CLI scripts, and jobs. It derives the same
   `<collection>.<action>` slugs as `PermissionCatalogService` (`list`/`get` →
@@ -180,6 +190,9 @@ the package root).
 - **Hooks**: `resolveUser` (invite-gating; default provisions via
   `getOrCreateFromOidc`), `resolveTenantId`, `buildExtras` (bootstrap
   `extras`; model JSON must use `toPublicJSON({ permissions })` — #1822).
+  `buildExtras` is the only app-domain bootstrap extension point. Never emit
+  app fields such as `dashboard` at the response top level: they are outside
+  `MobileSessionBootstrap` and the Kotlin decoder ignores them.
 - **Guard** wraps `withSessionPermissionContext`, so
   `assertOperationPermission`, tenancy context, and Postgres RLS all see the
   bearer caller; `OperationPermissionError` maps to 403 with a

package/README.md

@@ -495,8 +495,17 @@ TenantService supports three modes: `flexible` (no auto-create), `personal` (aut
 | `switchSessionTenant` | Change tenant context for current session |
 | `beginOidcLogin`, `completeOidcLogin` | Low-level SvelteKit helpers for custom OIDC login routes |
 | `createOidcLoginHandler`, `createOidcCallbackHandler` | Ready-to-use SvelteKit route handlers for OIDC login and callback |
+| `createMobileAuthHandlers` | Mountable `/api/mobile` PKCE, bearer session, bootstrap, logout, and route-guard handlers |
+| `resolveMobileUploadDedupKey` | Resolves `clientCaptureId` with `Idempotency-Key` fallback for app-owned multipart routes |
 | `SessionLocals` | Type for `event.locals` (extend in `app.d.ts`) |
 
+`createMobileAuthHandlers({ buildExtras })` places app-domain bootstrap data
+under `MobileSessionBootstrap.extras`. Do not add app fields at the response
+top level: they are outside the shared contract and the Kotlin client ignores
+unknown top-level keys. Multipart ingestion remains app-owned; follow
+[`mobile-upload-contract.md`](../../docs/content/architecture/mobile-upload-contract.md)
+for authentication, deduplication, and status semantics.
+
 ### Types & Constants
 
 | Export | Description |