@happyvertical/smrt-users 0.38.23 → 0.38.25
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/AGENTS.md +10 -0
- package/dist/chunks/{TerminalAuthService-BjKbfFLR.js → TerminalAuthService-CG31gDgA.js} +2 -2
- package/dist/chunks/{TerminalAuthService-BjKbfFLR.js.map → TerminalAuthService-CG31gDgA.js.map} +1 -1
- package/dist/index.js +3 -3
- package/dist/manifest.json +2 -2
- package/dist/smrt-knowledge.json +6 -6
- package/dist/sveltekit.js +1 -1
- package/package.json +11 -11
package/AGENTS.md
CHANGED
|
@@ -88,6 +88,16 @@ throw). The default seed leaves every role exact-tenant.
|
|
|
88
88
|
|
|
89
89
|
## Operation Permission Guards
|
|
90
90
|
|
|
91
|
+
SMRT derives a fine-grained, per-`<collection>.<action>` permission catalog **from the
|
|
92
|
+
manifest** (`PermissionCatalogService`, including custom `@smrt` actions — not just CRUD)
|
|
93
|
+
and enforces it two ways: app-side via `assertOperationPermission()` / `PermissionResolver`,
|
|
94
|
+
and at the database via generated **Postgres RLS** policies
|
|
95
|
+
(`generatePostgresPermissionSql()` / `applyPostgresPermissionPolicies()`) that read the
|
|
96
|
+
session-injected `smrt.permissions` / `smrt.tenant_id` (set by `withSessionPermissionContext`
|
|
97
|
+
via `set_config`). Because the RLS teeth are at the data layer, enforcement is door-agnostic
|
|
98
|
+
— REST, MCP, and in-process callers are all bounded once the principal's context is set.
|
|
99
|
+
Setup: README → *Manifest-derived permission catalog* and *Postgres RLS enforcement*.
|
|
100
|
+
|
|
91
101
|
- Use `assertOperationPermission()` for hand-written mutations in SvelteKit form
|
|
92
102
|
actions, custom endpoints, CLI scripts, and jobs. It derives the same
|
|
93
103
|
`<collection>.<action>` slugs as `PermissionCatalogService` (`list`/`get` →
|