@mercurjs/docs 2.3.6-canary.4 → 2.3.6-canary.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -270,6 +270,51 @@ File paths map to URL routes automatically.
|
|
|
270
270
|
| `src/routes/(settings)/page.tsx` | Route grouping | Groups routes without adding a URL segment |
|
|
271
271
|
| `src/routes/dashboard/@sidebar/page.tsx` | Parallel route | Renders alongside parent |
|
|
272
272
|
|
|
273
|
+
### Adding permissions from a plugin
|
|
274
|
+
|
|
275
|
+
A plugin that ships its own pages usually needs its own permission keys. Declare them on the server, then register the same keys with the dashboard SDK so pages can be guarded and hidden from navigation.
|
|
276
|
+
|
|
277
|
+
**1. Define the keys on the server.** Import the definitions file once (for example from your module's `index.ts`) so the keys join the catalog:
|
|
278
|
+
|
|
279
|
+
```typescript src/permissions.ts
|
|
280
|
+
import { defineMercurPermissions } from "@mercurjs/core/permissions/registry"
|
|
281
|
+
|
|
282
|
+
export const messagingPermissions = defineMercurPermissions([
|
|
283
|
+
{ key: "messaging", group: "messaging", surface: ["vendor"], rights: ["view", "edit", "manage"] },
|
|
284
|
+
])
|
|
285
|
+
```
|
|
286
|
+
|
|
287
|
+
Guard the plugin's API routes with the same key (`requirePermission("messaging", "view")`).
|
|
288
|
+
|
|
289
|
+
**2. Register the keys with the dashboard SDK.** `PermissionKey` is built from the `PermissionKeys` interface, so augment it:
|
|
290
|
+
|
|
291
|
+
```typescript src/permissions.d.ts
|
|
292
|
+
declare module "@mercurjs/dashboard-sdk" {
|
|
293
|
+
interface PermissionKeys {
|
|
294
|
+
messaging: true
|
|
295
|
+
}
|
|
296
|
+
}
|
|
297
|
+
|
|
298
|
+
export {}
|
|
299
|
+
```
|
|
300
|
+
|
|
301
|
+
The key now type-checks everywhere the SDK accepts a permission:
|
|
302
|
+
|
|
303
|
+
```tsx src/routes/messages/page.tsx
|
|
304
|
+
import type { RouteConfig, RouteHandle } from "@mercurjs/dashboard-sdk"
|
|
305
|
+
|
|
306
|
+
export const config: RouteConfig = {
|
|
307
|
+
label: "Messages",
|
|
308
|
+
permissions: ["messaging:view"],
|
|
309
|
+
}
|
|
310
|
+
|
|
311
|
+
export const handle: RouteHandle = {
|
|
312
|
+
permissions: "messaging:view",
|
|
313
|
+
}
|
|
314
|
+
```
|
|
315
|
+
|
|
316
|
+
`can("messaging", "edit")` and `buildPermission("messaging", "manage")` accept it too. This only affects types: the dashboard reads the member's effective rights from the API at runtime.
|
|
317
|
+
|
|
273
318
|
## Branding
|
|
274
319
|
|
|
275
320
|
Set `name` and `logo` in the plugin options to customize the sidebar header.
|