@inbeat/standards 0.7.0 → 0.7.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,12 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## [0.7.1](https://github.com/Genoux/ib-toolkit/compare/standards-v0.7.0...standards-v0.7.1) (2026-10-01)
|
|
4
|
+
|
|
5
|
+
|
|
6
|
+
### Bug Fixes
|
|
7
|
+
|
|
8
|
+
* **standards:** unknown roles get the app's least access, not always none ([#31](https://github.com/Genoux/ib-toolkit/issues/31)) ([34114ee](https://github.com/Genoux/ib-toolkit/commit/34114ee3da0fdfd14c663bf5ff93a52e9b4c3953))
|
|
9
|
+
|
|
3
10
|
## [0.7.0](https://github.com/Genoux/ib-toolkit/compare/standards-v0.6.1...standards-v0.7.0) (2026-10-01)
|
|
4
11
|
|
|
5
12
|
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@inbeat/standards",
|
|
3
|
-
"version": "0.7.
|
|
3
|
+
"version": "0.7.1",
|
|
4
4
|
"description": "Agent standards for inBeat apps: managed AGENTS.md block, skills under .agents/skills, ib CLI",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"bin": {
|
|
@@ -31,7 +31,7 @@
|
|
|
31
31
|
"test": "bun --bun vitest run"
|
|
32
32
|
},
|
|
33
33
|
"devDependencies": {
|
|
34
|
-
"@inbeat/config": "^0.7.
|
|
34
|
+
"@inbeat/config": "^0.7.1",
|
|
35
35
|
"vitest": "^4.1.1"
|
|
36
36
|
},
|
|
37
37
|
"repository": {
|
|
@@ -81,7 +81,8 @@ dashboard step to both.
|
|
|
81
81
|
sign-ups open and rely on roles.
|
|
82
82
|
- Roles: `publicMetadata.role`, assigned in the Clerk dashboard (users cannot edit it). Expose it
|
|
83
83
|
with the session token claim `{"metadata": "{{user.public_metadata}}"}`, read it from
|
|
84
|
-
`sessionClaims.metadata.role`. No role or an unknown one
|
|
84
|
+
`sessionClaims.metadata.role`. No role or an unknown one gets the least access the app has:
|
|
85
|
+
none, or its default role (e.g. member, creator). Never fall back to a privileged role.
|
|
85
86
|
- Checks run on the server, twice: the proxy requires sign-in outside the public routes and blocks
|
|
86
87
|
role-gated areas; every role-gated page, action and route checks again (`authorize`). Hiding UI
|
|
87
88
|
is not access control.
|
|
@@ -81,7 +81,8 @@ dashboard step to both.
|
|
|
81
81
|
sign-ups open and rely on roles.
|
|
82
82
|
- Roles: `publicMetadata.role`, assigned in the Clerk dashboard (users cannot edit it). Expose it
|
|
83
83
|
with the session token claim `{"metadata": "{{user.public_metadata}}"}`, read it from
|
|
84
|
-
`sessionClaims.metadata.role`. No role or an unknown one
|
|
84
|
+
`sessionClaims.metadata.role`. No role or an unknown one gets the least access the app has:
|
|
85
|
+
none, or its default role (e.g. member, creator). Never fall back to a privileged role.
|
|
85
86
|
- Checks run on the server, twice: the proxy requires sign-in outside the public routes and blocks
|
|
86
87
|
role-gated areas; every role-gated page, action and route checks again (`authorize`). Hiding UI
|
|
87
88
|
is not access control.
|