@i4e/invest4edu-access-core 0.5.0 → 0.6.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +1 -1
- package/src/role-capabilities.js +6 -2
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@i4e/invest4edu-access-core",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.6.0",
|
|
4
4
|
"description": "Shared access-control primitives for NeoFindesk: tenant keystone, role capabilities, reportee tree, feature flags, and the unified access engine (registry schema, snapshot resolver, visibleWhen).",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"exports": {
|
package/src/role-capabilities.js
CHANGED
|
@@ -30,6 +30,10 @@ export const CAPABILITY_FLAGS = Object.freeze([
|
|
|
30
30
|
"canCrossAccount",
|
|
31
31
|
"productScoped",
|
|
32
32
|
"bypassAllGates",
|
|
33
|
+
// Edit the GLOBAL feature registry (modules/screens/actions + their flags). Deliberately
|
|
34
|
+
// narrower than canGovernDelegation: that includes per-account BROKER_ADMINs, and the registry
|
|
35
|
+
// is cross-account — one edit changes what every tenant sees.
|
|
36
|
+
"canManageRegistry",
|
|
33
37
|
]);
|
|
34
38
|
|
|
35
39
|
/**
|
|
@@ -42,8 +46,8 @@ export const CAPABILITY_FLAGS = Object.freeze([
|
|
|
42
46
|
export const DEFAULT_ROLE_CAPABILITIES = Object.freeze({
|
|
43
47
|
// bypassAllGates (D27) defaults to the two platform-admin roles. Inert until the access
|
|
44
48
|
// engine reads it, and revocable from the `rolecapabilities` collection with no deploy.
|
|
45
|
-
SUPER_ADMIN: { isFullAccess: true, canGovernDelegation: true, canCorrectE1: true, bypassAllGates: true },
|
|
46
|
-
SYSTEM_ADMIN: { isFullAccess: true, canGovernDelegation: true, canCorrectE1: true, bypassAllGates: true },
|
|
49
|
+
SUPER_ADMIN: { isFullAccess: true, canGovernDelegation: true, canCorrectE1: true, bypassAllGates: true, canManageRegistry: true },
|
|
50
|
+
SYSTEM_ADMIN: { isFullAccess: true, canGovernDelegation: true, canCorrectE1: true, bypassAllGates: true, canManageRegistry: true },
|
|
47
51
|
BROKER_ADMIN: { isFullAccess: true, canGovernDelegation: true, canCorrectE1: true },
|
|
48
52
|
BACKOFFICE_USER: { isFullAccess: true, canCorrectE1: true },
|
|
49
53
|
HR_USER: { isFullAccess: true },
|