@i4e/invest4edu-access-core 0.6.0 → 0.6.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@i4e/invest4edu-access-core",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Shared access-control primitives for NeoFindesk: tenant keystone, role capabilities, reportee tree, feature flags, and the unified access engine (registry schema, snapshot resolver, visibleWhen).",
   "type": "module",
   "exports": {

package/src/access-resolver.js

@@ -173,9 +173,16 @@ export function resolveAccessSnapshot({
     : mergeGrants(grants, { mappedProducts, now });
 
   const byCode = new Map(features.map((f) => [f.feature_code, f]));
-  const productScope = bypass
+  // Product scope comes from the IDENTITY, for admins too. The loader already resolves an
+  // unmapped identity (internal staff, platform admins) to every product code, so this is "all"
+  // for them without any special case. Deriving a bypass admin's scope from the products declared
+  // ON FEATURES — as this used to — yields [] whenever no feature declares one, which is the state
+  // of the registry today: a system admin resolved to NO products, and every feature then inherited
+  // `products: []`. Kept only as a fallback for the case where identity scope is genuinely empty.
+  const identityScope = [...new Set(mappedProducts.map(String))];
+  const productScope = bypass && !identityScope.length
     ? [...new Set(features.flatMap((f) => f.products || []))]
-    : [...new Set(mappedProducts.map(String))];
+    : identityScope;
 
   const featureMap = {};
   const allowedScreens = [];