@i4e/invest4edu-access-core 0.5.0 → 0.6.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@i4e/invest4edu-access-core",
-  "version": "0.5.0",
+  "version": "0.6.1",
   "description": "Shared access-control primitives for NeoFindesk: tenant keystone, role capabilities, reportee tree, feature flags, and the unified access engine (registry schema, snapshot resolver, visibleWhen).",
   "type": "module",
   "exports": {

package/src/access-resolver.js

@@ -173,9 +173,16 @@ export function resolveAccessSnapshot({
     : mergeGrants(grants, { mappedProducts, now });
 
   const byCode = new Map(features.map((f) => [f.feature_code, f]));
-  const productScope = bypass
+  // Product scope comes from the IDENTITY, for admins too. The loader already resolves an
+  // unmapped identity (internal staff, platform admins) to every product code, so this is "all"
+  // for them without any special case. Deriving a bypass admin's scope from the products declared
+  // ON FEATURES — as this used to — yields [] whenever no feature declares one, which is the state
+  // of the registry today: a system admin resolved to NO products, and every feature then inherited
+  // `products: []`. Kept only as a fallback for the case where identity scope is genuinely empty.
+  const identityScope = [...new Set(mappedProducts.map(String))];
+  const productScope = bypass && !identityScope.length
     ? [...new Set(features.flatMap((f) => f.products || []))]
-    : [...new Set(mappedProducts.map(String))];
+    : identityScope;
 
   const featureMap = {};
   const allowedScreens = [];

package/src/role-capabilities.js

@@ -30,6 +30,10 @@ export const CAPABILITY_FLAGS = Object.freeze([
   "canCrossAccount",
   "productScoped",
   "bypassAllGates",
+  // Edit the GLOBAL feature registry (modules/screens/actions + their flags). Deliberately
+  // narrower than canGovernDelegation: that includes per-account BROKER_ADMINs, and the registry
+  // is cross-account — one edit changes what every tenant sees.
+  "canManageRegistry",
 ]);
 
 /**
@@ -42,8 +46,8 @@ export const CAPABILITY_FLAGS = Object.freeze([
 export const DEFAULT_ROLE_CAPABILITIES = Object.freeze({
   // bypassAllGates (D27) defaults to the two platform-admin roles. Inert until the access
   // engine reads it, and revocable from the `rolecapabilities` collection with no deploy.
-  SUPER_ADMIN: { isFullAccess: true, canGovernDelegation: true, canCorrectE1: true, bypassAllGates: true },
-  SYSTEM_ADMIN: { isFullAccess: true, canGovernDelegation: true, canCorrectE1: true, bypassAllGates: true },
+  SUPER_ADMIN: { isFullAccess: true, canGovernDelegation: true, canCorrectE1: true, bypassAllGates: true, canManageRegistry: true },
+  SYSTEM_ADMIN: { isFullAccess: true, canGovernDelegation: true, canCorrectE1: true, bypassAllGates: true, canManageRegistry: true },
   BROKER_ADMIN: { isFullAccess: true, canGovernDelegation: true, canCorrectE1: true },
   BACKOFFICE_USER: { isFullAccess: true, canCorrectE1: true },
   HR_USER: { isFullAccess: true },