@happyvertical/smrt-users 0.38.23 → 0.38.25

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/AGENTS.md CHANGED
@@ -88,6 +88,16 @@ throw). The default seed leaves every role exact-tenant.
88
88
 
89
89
  ## Operation Permission Guards
90
90
 
91
+ SMRT derives a fine-grained, per-`<collection>.<action>` permission catalog **from the
92
+ manifest** (`PermissionCatalogService`, including custom `@smrt` actions — not just CRUD)
93
+ and enforces it two ways: app-side via `assertOperationPermission()` / `PermissionResolver`,
94
+ and at the database via generated **Postgres RLS** policies
95
+ (`generatePostgresPermissionSql()` / `applyPostgresPermissionPolicies()`) that read the
96
+ session-injected `smrt.permissions` / `smrt.tenant_id` (set by `withSessionPermissionContext`
97
+ via `set_config`). Because the RLS teeth are at the data layer, enforcement is door-agnostic
98
+ — REST, MCP, and in-process callers are all bounded once the principal's context is set.
99
+ Setup: README → *Manifest-derived permission catalog* and *Postgres RLS enforcement*.
100
+
91
101
  - Use `assertOperationPermission()` for hand-written mutations in SvelteKit form
92
102
  actions, custom endpoints, CLI scripts, and jobs. It derives the same
93
103
  `<collection>.<action>` slugs as `PermissionCatalogService` (`list`/`get` →