@open-mercato/core 0.6.7-develop.6685.1.77c0a5591b → 0.6.7-develop.6687.1.46a258e592
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@open-mercato/core",
|
|
3
|
-
"version": "0.6.7-develop.
|
|
3
|
+
"version": "0.6.7-develop.6687.1.46a258e592",
|
|
4
4
|
"license": "MIT",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "./dist/index.js",
|
|
@@ -254,16 +254,16 @@
|
|
|
254
254
|
"zod": "^4.4.3"
|
|
255
255
|
},
|
|
256
256
|
"peerDependencies": {
|
|
257
|
-
"@open-mercato/ai-assistant": "0.6.7-develop.
|
|
258
|
-
"@open-mercato/shared": "0.6.7-develop.
|
|
259
|
-
"@open-mercato/ui": "0.6.7-develop.
|
|
257
|
+
"@open-mercato/ai-assistant": "0.6.7-develop.6687.1.46a258e592",
|
|
258
|
+
"@open-mercato/shared": "0.6.7-develop.6687.1.46a258e592",
|
|
259
|
+
"@open-mercato/ui": "0.6.7-develop.6687.1.46a258e592",
|
|
260
260
|
"react": "^19.0.0",
|
|
261
261
|
"react-dom": "^19.0.0"
|
|
262
262
|
},
|
|
263
263
|
"devDependencies": {
|
|
264
|
-
"@open-mercato/ai-assistant": "0.6.7-develop.
|
|
265
|
-
"@open-mercato/shared": "0.6.7-develop.
|
|
266
|
-
"@open-mercato/ui": "0.6.7-develop.
|
|
264
|
+
"@open-mercato/ai-assistant": "0.6.7-develop.6687.1.46a258e592",
|
|
265
|
+
"@open-mercato/shared": "0.6.7-develop.6687.1.46a258e592",
|
|
266
|
+
"@open-mercato/ui": "0.6.7-develop.6687.1.46a258e592",
|
|
267
267
|
"@testing-library/dom": "^10.4.1",
|
|
268
268
|
"@testing-library/jest-dom": "^6.9.1",
|
|
269
269
|
"@testing-library/react": "^16.3.1",
|
|
@@ -6,7 +6,7 @@ The auth module handles authentication, authorization, users, roles, and RBAC.
|
|
|
6
6
|
|
|
7
7
|
1. Hash passwords with `bcryptjs` using cost >= 10.
|
|
8
8
|
2. Use `findWithDecryption` / `findOneWithDecryption` for user queries.
|
|
9
|
-
3.
|
|
9
|
+
3. Use declarative `requireFeatures` in page/API metadata for access control; never add role-name guards such as `requireRoles: ['admin']`.
|
|
10
10
|
4. Declare every module feature in `acl.ts` and seed role grants through `setup.ts`.
|
|
11
11
|
5. Use wildcard-aware helpers such as `matchFeature`, `hasFeature`, and `hasAllFeatures` when inspecting raw granted features.
|
|
12
12
|
|
|
@@ -20,6 +20,7 @@ The auth module handles authentication, authorization, users, roles, and RBAC.
|
|
|
20
20
|
- Never log credentials, password reset tokens, session tokens, or decrypted user secrets.
|
|
21
21
|
- Never reveal whether an email exists through auth error messages.
|
|
22
22
|
- Never check raw ACL arrays with `includes(...)`, `Set.has(...)`, or ad hoc wildcard logic.
|
|
23
|
+
- Never authorize a new page or API by mutable role name; declare a stable feature and gate with `requireFeatures`.
|
|
23
24
|
|
|
24
25
|
## Validation Commands
|
|
25
26
|
|
|
@@ -78,16 +79,17 @@ Features are string-based permissions: `<module>.<action>` (e.g., `users.view`,
|
|
|
78
79
|
|
|
79
80
|
### Declarative Guards
|
|
80
81
|
|
|
81
|
-
|
|
82
|
+
Use declarative feature guards in page/API metadata. API metadata is per HTTP method:
|
|
82
83
|
|
|
83
84
|
```typescript
|
|
84
85
|
export const metadata = {
|
|
85
|
-
requireAuth: true,
|
|
86
|
-
|
|
87
|
-
requireFeatures: ['users.manage'],
|
|
86
|
+
GET: { requireAuth: true, requireFeatures: ['auth.users.list'] },
|
|
87
|
+
POST: { requireAuth: true, requireFeatures: ['auth.users.create'] },
|
|
88
88
|
}
|
|
89
89
|
```
|
|
90
90
|
|
|
91
|
+
For `page.meta.ts`, export the same `requireAuth: true` and `requireFeatures: [...]` fields at the page metadata top level. `requireRoles` remains a deprecated compatibility field for old registrations; never use it for new authorization.
|
|
92
|
+
|
|
91
93
|
## Key Directories
|
|
92
94
|
|
|
93
95
|
| Directory | Purpose |
|