@quazardous/qdadm 2.19.0 → 2.21.0

package/src/composables/useListPage.types.ts

@@ -3,6 +3,7 @@
  *
  * Extracted from useListPage.ts for maintainability.
  */
+import type { RouteStatePersister } from '../routeState'
 import type { Ref, ComputedRef } from 'vue'
 import type { Router } from 'vue-router'
 import type { FilterQuery } from '../query/FilterQuery'
@@ -76,9 +77,45 @@ export interface ColumnConfig {
 /**
  * Filter configuration
  */
-export interface FilterConfig {
-  name: string
-  type?: 'select' | 'multiselect' | 'date' | 'checkbox' | 'dropdown' | 'autocomplete'
+/**
+ * The filter controls qdadm knows how to render.
+ *
+ * Exported as a VALUE, not only a type, so a consumer's own guard can read
+ * this list instead of copying it — a copy goes stale the day a type is
+ * added and starts rejecting correct code.
+ */
+export const FILTER_TYPES = [
+  'select',
+  'multiselect',
+  'date',
+  'checkbox',
+  'dropdown',
+  'autocomplete',
+] as const
+
+export type FilterType = (typeof FILTER_TYPES)[number]
+
+/**
+ * Everything a filter can be given EXCEPT its name (#2147).
+ *
+ * Split out rather than written as `Omit<FilterConfig, 'name'>`, and the
+ * reason is not style. `FilterConfig` carries an index signature, so
+ * `keyof` includes `string`; `Exclude<string, 'name'>` is still `string`, and
+ * the `Omit` therefore collapsed to a bare `{ [x: string]: unknown }` —
+ * ERASING every declared property.
+ *
+ * `addFilter` took that type, so **no filter option was checked at all**:
+ * not `type`, not `optionLabel`, not `local_filter`. A consumer declared
+ * `type: 'text'`, TypeScript accepted it, and the filter rendered as an empty
+ * dropdown saying "No available options". Nothing was wrong at any single
+ * step, which is why it survived.
+ *
+ * Declaring the properties here and having `FilterConfig` extend it keeps the
+ * index signature — apps do stash their own keys — while the declared ones
+ * are checked again.
+ */
+export interface FilterOptions {
+  type?: FilterType
   placeholder?: string
   options?: Array<{ label: string; value: unknown }>
   default?: unknown
@@ -101,6 +138,10 @@ export interface FilterConfig {
   [key: string]: unknown
 }
 
+export interface FilterConfig extends FilterOptions {
+  name: string
+}
+
 /**
  * Row action configuration
  */
@@ -229,8 +270,27 @@ export interface UseListPageOptions<T = unknown> {
   persistFilters?: boolean
   /** Persist the active sort per entity (session storage), restored on init (#1218). Default true. */
   persistSort?: boolean
-  /** Sync filters to URL query params (default: true) */
+  /**
+   * WRITE filters, search and the page to the URL query (default: true).
+   *
+   * Writing only. `false` has never stopped the query string being read, so
+   * a deep link someone typed by hand still restores the list — say
+   * `routeState` if you want the state kept somewhere else entirely.
+   */
   syncUrlParams?: boolean
+  /**
+   * Where this list's state is remembered (#2146): a slug the framework
+   * knows (`'url'`, …), or your own persister. Defaults to the URL.
+   *
+   * Setting it is a deliberate choice of medium, so it answers
+   * `syncUrlParams` rather than obeying it: a list with `routeState` set
+   * reads and writes that medium whatever the URL flag says.
+   *
+   * An unknown slug throws rather than falling back to the URL — a list
+   * quietly persisting somewhere other than where you asked is worse than
+   * one that will not start (ADR 0011).
+   */
+  routeState?: string | RouteStatePersister
   /** Filter mode: 'auto' | 'manager' | 'local' */
   filterMode?: 'auto' | 'manager' | 'local'
   /** Auto-filter threshold for 'auto' mode */
@@ -270,6 +330,15 @@ export interface ListPageProps {
   lazy: boolean
   totalRecords: number
   rows: number
+  /**
+   * Row offset of the current page — what POSITIONS the paginator (#2145).
+   *
+   * In lazy mode the table renders exactly the rows it is handed and has no
+   * way to know which page they are; `first` is the only thing that tells it.
+   * Without it, a restored page 2 showed page 2's rows under a paginator
+   * highlighting 1.
+   */
+  first: number
   rowsPerPageOptions: number[]
   sortField: string | null
   sortOrder: number
@@ -382,7 +451,7 @@ export interface UseListPageReturn<T = unknown> {
   filterValues: Ref<Record<string, unknown>>
   filteredItems: ComputedRef<T[]>
   fromCache: Ref<boolean>
-  addFilter: (name: string, config: Omit<FilterConfig, 'name'>) => void
+  addFilter: (name: string, config: FilterOptions) => void
   removeFilter: (name: string) => void
   setFilterValue: (name: string, value: unknown) => void
   updateFilters: (values: Record<string, unknown>) => void

package/src/composables/useListPage.utils.ts

@@ -40,6 +40,35 @@ export function persistPageSize(size: number): void {
   setCookie(COOKIE_NAME, size, COOKIE_EXPIRY_DAYS)
 }
 
+/**
+ * Settle the rows-per-page a list opens on (#2146).
+ *
+ * The seam owns this now, so the stored value arrives from whichever medium
+ * the app chose. The LEGACY bare-number cookie is read only when the seam has
+ * nothing — an existing user's choice must survive the move, or a comfort
+ * setting they picked once quietly resets on upgrade.
+ *
+ * Anything outside {@link PAGE_SIZE_OPTIONS} falls back to the default: the
+ * value reaches us from a cookie or a query string that anyone can edit, and
+ * a row count the paginator cannot offer would leave its dropdown showing a
+ * blank.
+ */
+export function restorePageSize(stored: unknown, defaultSize: number): number {
+  const fromSeam = Number(stored)
+  if (PAGE_SIZE_OPTIONS.includes(fromSeam)) return fromSeam
+  return getSavedPageSize(defaultSize)
+}
+
+/**
+ * Drop the pre-seam cookie once its value has been carried over.
+ *
+ * Left in place it would outlive the setting it stands for by a year, and
+ * shadow the seam on any machine where the new store was cleared.
+ */
+export function retireLegacyPageSizeCookie(): void {
+  setCookie(COOKIE_NAME, '', -1)
+}
+
 // ─────────────────────────────────────────────────────────────────────────────
 // Default label formatter (snake_case → Title Case)
 // ─────────────────────────────────────────────────────────────────────────────
@@ -129,6 +158,35 @@ export function clearSessionSort(key: string): void {
   }
 }
 
+/**
+ * Settle the sort a list opens on (#2146).
+ *
+ * The seam owns this now. The medium has not changed — the default
+ * composition routes `sort` back to `sessionStorage`, deliberately, so that
+ * moving it behind an interface changes nothing anyone can observe. Only the
+ * KEY changed, from `qdadm_sort_offers` to `qdadm:offers:sort`.
+ *
+ * Which is why the legacy entry is still read when the seam has nothing: a
+ * sort somebody set five minutes ago must not vanish because the framework
+ * was upgraded under them.
+ */
+export function restoreSort(
+  stored: { sort?: unknown; sortOrder?: unknown } | null,
+  legacyKey: string,
+  defaults: SessionSort
+): SessionSort {
+  const field = stored?.sort
+  const order = Number(stored?.sortOrder)
+  if (typeof field === 'string' && field && (order === 1 || order === -1)) {
+    return { field, order }
+  }
+
+  const legacy = getSessionSort(legacyKey)
+  if (legacy) return legacy
+
+  return defaults
+}
+
 // ─────────────────────────────────────────────────────────────────────────────
 // Smart filter discovery
 // ─────────────────────────────────────────────────────────────────────────────

package/src/entity/EntityManager.interface.ts

@@ -27,6 +27,7 @@
 import type { EntityBadge } from './EntityManager.types'
 import type { SignalBus } from '../kernel/SignalBus'
 import type { EntityAuthAdapter } from './auth/EntityAuthAdapter'
+import type { RouteStatePersister } from '../routeState'
 
 // ─── Base ────────────────────────────────────────────────────────────────────
 
@@ -84,6 +85,16 @@ export interface EntityManagerRead<T = unknown> extends EntityManagerBase<T>, En
   getFieldConfig: (name: string) => unknown | null
   /** Config-carrying property: always present on the class, VALUE nullable */
   localFilterThreshold?: number | null
+  /**
+   * Where lists of this entity remember their state (#2146): a slug the
+   * framework knows, or a persister instance.
+   *
+   * A property of the ENTITY, so every screen showing it agrees — a list of
+   * audit rows nobody links to can say `local_storage` once here rather than
+   * on each of the four pages that render it. A list's own `routeState`
+   * still wins; the kernel default applies when neither says anything.
+   */
+  routeState?: string | RouteStatePersister
 }
 
 // ─── CRUD ────────────────────────────────────────────────────────────────────

package/src/entity/EntityManager.ts

@@ -51,6 +51,7 @@ export type {
 } from './EntityManager.types'
 
 // Import concrete types needed in method signatures
+import type { RouteStatePersister } from '../routeState'
 import type {
   RoutingContext,
   PresaveContext,
@@ -88,6 +89,8 @@ export class EntityManager<T extends EntityRecord = EntityRecord> {
   protected _fields: Record<string, FieldConfig>
 
   localFilterThreshold: number | null
+  /** Where lists of this entity remember their state (#2146); null = inherit. */
+  routeState: string | RouteStatePersister | null
   /** Default null placement for local sorts (#1222); field-level nullSort wins. */
   nullSort?: NullSortMode
   protected _cacheTtlMs: number | null
@@ -163,6 +166,7 @@ export class EntityManager<T extends EntityRecord = EntityRecord> {
       badges = null,
       fields = {},
       localFilterThreshold = null,
+      routeState = null,
       nullSort,
       cacheTtlMs = null,
       asymmetric = false,
@@ -196,6 +200,7 @@ export class EntityManager<T extends EntityRecord = EntityRecord> {
     this._fields = fields
 
     this.localFilterThreshold = localFilterThreshold
+    this.routeState = routeState
     this.nullSort = nullSort
     this._cacheTtlMs = cacheTtlMs
     this._asymmetric = asymmetric

package/src/entity/EntityManager.types.ts

@@ -16,6 +16,7 @@ import type { HookRegistry } from '../hooks/HookRegistry'
 
 // Circular type import — safe because `import type` is erased at runtime
 import type { EntityManager } from './EntityManager'
+import type { RouteStatePersister } from '../routeState'
 
 // ============ INTERNAL TYPES ============
 
@@ -235,6 +236,16 @@ export interface EntityManagerOptions<T extends EntityRecord = EntityRecord> {
   badges?: (entity: T) => EntityBadge[]
   fields?: Record<string, FieldConfig>
   localFilterThreshold?: number | null
+  /**
+   * Where lists of this entity remember their state (#2146): a slug the
+   * framework knows, or a persister instance.
+   *
+   * A property of the ENTITY, so every screen showing it agrees — a list of
+   * audit rows nobody links to can say `local_storage` once here rather than
+   * on each of the four pages that render it. A list's own `routeState`
+   * still wins; the kernel default applies when neither says anything.
+   */
+  routeState?: string | RouteStatePersister
   /** Default null placement for local sorts: 'first' | 'last' | 'low' | 'high' (default 'last', #1222). Field-level nullSort wins. */
   nullSort?: NullSortMode
   /** Cache TTL in milliseconds (0=disabled, -1=infinite, >0=TTL). Overrides global, overridden by storage. */

package/src/entity/auth/SecurityChecker.ts

@@ -15,6 +15,43 @@ export interface RoleProvider {
   readonly canPersist: boolean
 }
 
+/**
+ * What an application's judge receives at install time (#2225).
+ */
+export interface GrantJudgeContext {
+  orchestrator?: unknown
+  signals?: unknown
+  /**
+   * The live permission registry — a REFERENCE, not a snapshot.
+   *
+   * `install` runs while the Kernel is still being built, before modules
+   * register their entities, so `getKeys()` called here returns only the
+   * framework's own namespaces. Read the keys when you pre-warm (after login,
+   * before mount), not in `install`.
+   */
+  permissionRegistry?: { getKeys(): string[] }
+}
+
+/**
+ * An application-provided judgement of permissions (#2225).
+ *
+ * For apps whose backend decides who may do what: the judge answers from its
+ * own cache instead of qdadm's role matrix. It is consulted FIRST, for roles
+ * and permissions alike.
+ *
+ * - `true` / `false` is the verdict.
+ * - Anything else (`undefined`, `null`, a cache miss) falls through to the
+ *   built-in judgement, which stays the default.
+ * - A judge that THROWS denies — see `SecurityChecker._judge`.
+ *
+ * `isGranted` is called synchronously on every check, so answer from memory.
+ * Fetch in bulk beforehand and emit `security:changed` when answers change.
+ */
+export interface GrantJudge {
+  isGranted(attribute: string, subject: unknown, user: AuthUser): boolean | undefined
+  install?(ctx: GrantJudgeContext): void
+}
+
 /**
  * SecurityChecker constructor options
  */
@@ -22,6 +59,8 @@ export interface SecurityCheckerOptions {
   rolesProvider?: RoleProvider
   roleHierarchy?: RoleHierarchy | RoleHierarchyConfig
   rolePermissions?: Record<string, string[]>
+  /** Application-provided judgement, consulted first (#2225). */
+  grant?: GrantJudge
   getCurrentUser: () => AuthUser | null
 }
 
@@ -32,6 +71,8 @@ export interface SecurityCheckerConfig {
   rolesProvider?: RoleProvider
   role_hierarchy?: RoleHierarchyConfig
   role_permissions?: Record<string, string[]>
+  /** Application-provided judgement, consulted first (#2225). */
+  grant?: GrantJudge
   getCurrentUser: () => AuthUser | null
 }
 
@@ -55,8 +96,12 @@ export class SecurityChecker {
   readonly getCurrentUser: () => AuthUser | null
   /** Roles already warned about (warn-once, #1388) */
   protected _warnedRoles = new Set<string>()
+  /** Application-provided judgement, consulted before the role matrix (#2225) */
+  protected _grant: GrantJudge | null
+  /** Attributes whose judge already threw (report-once) */
+  protected _judgeFailures = new Set<string>()
 
-  constructor({ rolesProvider, roleHierarchy, rolePermissions, getCurrentUser }: SecurityCheckerOptions) {
+  constructor({ rolesProvider, roleHierarchy, rolePermissions, grant, getCurrentUser }: SecurityCheckerOptions) {
     if (rolesProvider) {
       this._rolesProvider = rolesProvider
     } else {
@@ -75,6 +120,12 @@ export class SecurityChecker {
     }
 
     this.getCurrentUser = getCurrentUser
+    this._grant = grant ?? null
+  }
+
+  /** The application's judge, when one is configured (#2225). */
+  get grant(): GrantJudge | null {
+    return this._grant
   }
 
   /**
@@ -108,10 +159,15 @@ export class SecurityChecker {
    *
    * This is the main contract method, similar to Symfony's isGranted().
    */
-  isGranted(attribute: string, _subject: unknown = null): boolean {
+  isGranted(attribute: string, subject: unknown = null): boolean {
     const user = this.getCurrentUser()
     if (!user) return false
 
+    // 0. The application's own judgement comes first (#2225). A boolean is a
+    //    verdict; anything else falls through to the built-in matrix below.
+    const verdict = this._judge(attribute, subject, user)
+    if (verdict !== undefined) return verdict
+
     // 1. Check if it's a role (ROLE_*)
     if (attribute.startsWith('ROLE_')) {
       return this.roleHierarchy.isGrantedRole(user.roles || [user.role || ''], attribute)
@@ -122,6 +178,34 @@ export class SecurityChecker {
     return PermissionMatcher.any(userPerms, attribute)
   }
 
+  /**
+   * Ask the application's judge, if any.
+   *
+   * A judge that THROWS denies. Falling through to the built-in matrix would
+   * quietly substitute a different authority for the one the app configured,
+   * and failing open would grant whatever the backend never got to answer —
+   * the worst direction a security check can fail in (the rule the route
+   * guard already follows, #1190). Reported once per attribute.
+   */
+  protected _judge(attribute: string, subject: unknown, user: AuthUser): boolean | undefined {
+    if (!this._grant) return undefined
+    let answer: unknown
+    try {
+      answer = this._grant.isGranted(attribute, subject, user)
+    } catch (error) {
+      if (!this._judgeFailures.has(attribute)) {
+        this._judgeFailures.add(attribute)
+        console.error(
+          `[qdadm] security.grant threw while judging "${attribute}" — DENIED. ` +
+            `A failing judge denies rather than falling back to the role matrix.`,
+          error
+        )
+      }
+      return false
+    }
+    return typeof answer === 'boolean' ? answer : undefined
+  }
+
   /**
    * Get all permissions for a user (resolved from roles + user overrides)
    */
@@ -203,6 +287,7 @@ export function createSecurityChecker(config: SecurityCheckerConfig): SecurityCh
   if (config.rolesProvider) {
     return new SecurityChecker({
       rolesProvider: config.rolesProvider,
+      grant: config.grant,
       getCurrentUser: config.getCurrentUser,
     })
   }
@@ -213,6 +298,7 @@ export function createSecurityChecker(config: SecurityCheckerConfig): SecurityCh
       role_hierarchy: config.role_hierarchy || {},
       role_permissions: config.role_permissions || {},
     }),
+    grant: config.grant,
     getCurrentUser: config.getCurrentUser,
   })
 }

package/src/entity/auth/index.ts

@@ -23,6 +23,8 @@ export type {
   RoleProvider,
   SecurityCheckerOptions,
   SecurityCheckerConfig,
+  GrantJudge,
+  GrantJudgeContext,
 } from './SecurityChecker'
 
 // Implementations

package/src/entity/storage/ApiStorage.ts

@@ -151,7 +151,7 @@ export class ApiStorage<T extends EntityRecord = EntityRecord> extends IStorage<
   }
 
   async list(params: ListParams = {}, context: RoutingContext | null = null): Promise<ListResult<T>> {
-    const { page = 1, page_size = 20, sort_by, sort_order, filters = {} } = params
+    const { page = 1, page_size = 20, sort_by, sort_order, search, filters = {} } = params
 
     // `paramMapping` covers the WHOLE outgoing query, pagination included
     // (#2113). It used to be applied to the filters only, so `status` could
@@ -160,9 +160,23 @@ export class ApiStorage<T extends EntityRecord = EntityRecord> extends IStorage<
     // storage for that alone. The names qdadm uses internally are its own
     // business; what goes on the wire is the backend's.
     //
+    // `search` goes out too (#2147). It is part of `ListParams` and always
+    // has been, but this method never read it — a user typed in the search
+    // box, the list rebuilt its query, and the term was dropped here without
+    // a word. The rows came back unfiltered and nothing anywhere said why,
+    // which is the silent no-op ADR 0011 exists to forbid.
+    //
+    // It travels under whatever name your backend uses, like every other key:
+    // `paramMapping: { search: 'q' }`.
+    //
+    // `searchFields` deliberately stays behind. It says which fields the
+    // FRONT should look at when filtering a cached page locally; a backend
+    // that searches knows its own columns, and shipping an array parameter
+    // nobody asked for would be a new surprise in place of the old one.
+    //
     // Filters keep their precedence over the pagination keys, exactly as
     // before: a filter named `page` still wins, for better or worse.
-    const outgoing = { page, page_size, sort_by, sort_order, ...filters }
+    const outgoing = { page, page_size, sort_by, sort_order, search, ...filters }
 
     const response = await this.client.get<Record<string, unknown>>(this.endpoint, {
       params: this._applyParamMapping(outgoing),

package/src/entity/storage/LocalStorage.ts

@@ -67,7 +67,7 @@ export class LocalStorage<T extends EntityRecord = EntityRecord> extends IStorag
     items = filterItems(items, filters, { stringMatch: 'exact' })
 
     // Apply search (shared pipeline, #1192)
-    items = searchItems(items, search as string | undefined)
+    items = searchItems(items, search)
 
     const total = items.length
 

package/src/entity/storage/MemoryStorage.ts

@@ -1,7 +1,7 @@
 import { IStorage } from './IStorage'
 import type { EntityRecord, ListParams, ListResult, StorageCapabilities } from '../../types'
 import { StorageError } from './errors'
-import { sortItems, filterItems, paginate, defaultGenerateId } from '../../query/clientFilter'
+import { sortItems, filterItems, paginate, defaultGenerateId, searchItems } from '../../query/clientFilter'
 
 /**
  * MemoryStorage options
@@ -61,10 +61,15 @@ export class MemoryStorage<T extends EntityRecord = EntityRecord> extends IStora
   }
 
   async list(params: ListParams = {}): Promise<ListResult<T>> {
-    const { page = 1, page_size = 20, sort_by, sort_order = 'asc', filters = {} } = params
+    const { page = 1, page_size = 20, sort_by, sort_order = 'asc', filters = {}, search } = params
 
     let items = this._getAll()
 
+    // Apply the search term (#2147). `searchItems` has existed since #1192
+    // and LocalStorage and MockApiStorage both called it; this one never did,
+    // so a search box over a MemoryStorage entity typed into the void.
+    items = searchItems(items, search)
+
     // Apply filters (shared pipeline, #1192 — legacy substring semantics)
     items = filterItems(items, filters, { stringMatch: 'includes' })
 

package/src/entity/storage/MockApiStorage.ts

@@ -151,7 +151,7 @@ export class MockApiStorage<T extends EntityRecord = EntityRecord> extends IStor
     }
 
     // Apply search (shared pipeline, #1192)
-    items = searchItems(items, search as string | undefined)
+    items = searchItems(items, search)
 
     const total = items.length
 

package/src/entity/storage/SdkStorage.ts

@@ -1,6 +1,6 @@
 import { IStorage } from './IStorage'
 import type { EntityRecord, ListParams, ListResult, StorageCapabilities } from '../../types'
-import { sortItems, filterItems, paginate } from '../../query/clientFilter'
+import { sortItems, filterItems, paginate, searchItems } from '../../query/clientFilter'
 
 /**
  * SDK method result with data property
@@ -275,9 +275,13 @@ export class SdkStorage<T extends EntityRecord = EntityRecord> extends IStorage<
   }
 
   async list(params: ListParams = {}): Promise<ListResult<T>> {
-    const { page = 1, page_size = 20, sort_by, sort_order = 'asc', filters = {} } = params
+    const { page = 1, page_size = 20, sort_by, sort_order = 'asc', filters = {}, search } = params
 
-    const queryParams = { query: { page, page_size, sort_by, sort_order, ...filters } }
+    // `search` goes to the SDK with everything else (#2147). It was dropped
+    // here, so a search box over an SDK-backed entity typed into the void:
+    // the call went out without the term and the rows came back unfiltered,
+    // with nothing anywhere saying why.
+    const queryParams = { query: { page, page_size, sort_by, sort_order, search, ...filters } }
     const data = (await this._execute('list', queryParams)) as ListResult<T>
 
     let { items, total } = data
@@ -292,8 +296,13 @@ export class SdkStorage<T extends EntityRecord = EntityRecord> extends IStorage<
 
       // Shared pipeline (#1192) — original order preserved: sort, then
       // filter (substring semantics), then paginate.
+      //
+      // The search is applied here TOO, not only sent (#2147). An SDK that
+      // ignores the term would otherwise hand back the whole collection and
+      // this branch would paginate it as if it had been searched.
       items = sortItems([...items], sort_by, sort_order)
       items = filterItems(items, filters, { stringMatch: 'includes' })
+      items = searchItems(items, search)
       total = items.length
       items = paginate(items, page, page_size)
     }

package/src/index.ts

@@ -237,10 +237,13 @@ export * from './composables/useJsonSyntax'
 export {
   useListPage,
   PAGE_SIZE_OPTIONS,
+  FILTER_TYPES,
   type UseListPageOptions,
   type UseListPageReturn,
   type ColumnConfig,
   type FilterConfig,
+  type FilterOptions,
+  type FilterType,
   type ActionConfig as ListActionConfig,
   type ResolvedAction,
   type HeaderActionConfig,
@@ -322,6 +325,22 @@ export {
   type LayoutMeta,
 } from './composables/useLayoutResolver'
 export { useSSEBridge, type UseSSEBridgeReturn } from './composables/useSSEBridge'
+
+// Route-state persistence (#2146) — where a route remembers what it shows.
+export {
+  UrlPersister,
+  isRouteStatePersister,
+  resolveRouteStatePersister,
+  createRouteStatePersisterFactory,
+  type RouteStatePersister,
+  type RouteStateScope,
+  type RouteStatePersisterSpec,
+  type RouteStatePersisterFactory,
+  type UrlPersisterOptions,
+  dottedKeyLocator,
+  namespacedKeyLocator,
+  type RouteStateKeyLocator,
+} from './routeState'
 export {
   useDeferred,
   useDeferredValue,

package/src/kernel/Kernel.auth.ts

@@ -120,11 +120,15 @@ export function applyAuthMethods(KernelClass: { prototype: Kernel }): void {
    */
   proto._setupAuthInvalidation = function (this: Self): void {
     const debug = this.options.debug ?? false
+    // `security:changed` (#2225) rides the same path: nothing on screen reads
+    // permissions reactively (canCreate, menu filtering and the route guard
+    // all ask synchronously), so a remount is what makes new answers show.
     const authSignals = [
       'auth:login',
       'auth:logout',
       'auth:impersonate',
       'auth:impersonate:stop',
+      'security:changed',
     ]
 
     for (const signal of authSignals) {