@svadmin/core 0.34.0 → 0.34.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@svadmin/core",
-  "version": "0.34.0",
+  "version": "0.34.2",
   "author": "zuohuadong",
   "repository": {
     "type": "git",
@@ -9,14 +9,14 @@
   },
   "main": "src/index.ts",
   "devDependencies": {
-    "@happy-dom/global-registrator": "^20.11.1",
-    "@sveltejs/vite-plugin-svelte": "^7.2.0",
+    "@happy-dom/global-registrator": "^20.11.2",
+    "@sveltejs/vite-plugin-svelte": "^7.3.0",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/svelte": "^5.4.2",
-    "@testing-library/user-event": "^14.6.1",
+    "@testing-library/user-event": "^14.6.3",
     "@types/bun": "^1.3.14",
-    "@types/jsdom": "^28.0.3",
-    "happy-dom": "^20.11.1",
+    "@types/jsdom": "^30.0.0",
+    "happy-dom": "^20.11.2",
     "jsdom": "^30.0.1",
     "vitest": "^4.1.10"
   },

package/src/auth-hooks.svelte.ts

@@ -269,11 +269,14 @@ export function useOnError() {
 // ─── usePermissions ──────────────────────────────────────────
 
 /**
- * Fetches permissions from authProvider.getPermissions().
- * Returns a reactive object with convenience methods for permission checks.
- * 
+ * Fetches UI-only hints from authProvider.getPermissions().
+ * Returns a reactive UI helper with convenience methods for permission checks.
+ * The result can change labels, navigation, and disabled controls, but it runs
+ * in the browser and never authorizes API, RLS, or action requests. Those
+ * requests must be independently authenticated and authorized by the backend.
+ *
  * Supports `refetch()` for session-level permission refresh (e.g., after role change).
- * 
+ *
  * @example
  * ```svelte
  * <script>

package/src/permissions.svelte.ts

@@ -20,8 +20,9 @@ export interface CanResult {
 
 
 /**
- * Formal Access Control Provider interface.
- * Implement this to define your authorization logic.
+ * UI access-control integration point.
+ * It can mirror a backend policy decision for navigation and controls, but browser
+ * checks never authorize an API request. The backend must enforce the same policy.
  *
  * @example
  * ```ts
@@ -78,8 +79,8 @@ export function getAccessControlOptions() {
 }
 
 /**
- * Async access check. 
- * Supports both single capability requests or an array of batched checks.
+ * UI access check supporting single capabilities or a batch.
+ * Its result can change browser presentation but never authorizes the backend action.
  */
 export async function canAccessAsync(params: CanParams[]): Promise<CanResult[]>;
 export async function canAccessAsync(resource: string, action: Action, params?: Record<string, unknown>, meta?: Record<string, unknown>): Promise<CanResult>;
@@ -100,7 +101,7 @@ export async function canAccessAsync(resourceOrBatch: string | CanParams[], acti
 // ─── Feature Gate ─────────────────────────────────────────────
 
 export interface FeatureGateConfig {
-  /** 允许访问的角色列表 */
+  /** 仅用于前端展示的角色列表。 */
   roles?: string[];
   /**
    * 需要的最低角色 (含以上所有角色)。
@@ -112,18 +113,20 @@ export interface FeatureGateConfig {
    * 由调用方按自身业务定义，框架不预设任何角色。
    */
   roleHierarchy?: string[];
-  /** 需要的权限列表 (全部匹配) */
+  /** 仅用于前端展示的权限列表 (全部匹配)。 */
   permissions?: string[];
 }
 
+/** 浏览器中的角色和权限提示，不是授权凭据。 */
 export interface FeatureGateUser {
   role: string;
   permissions: string[];
 }
 
 /**
- * 创建功能门控函数 — 基于角色和权限判断用户是否可访问某功能。
- * 不预设任何角色层级，由调用方完全定义。
+ * 创建仅用于前端展示的功能门控函数。
+ * 只做客户端 UI 门控；输入可被篡改，后端必须独立完成令牌验证和操作授权。
+ * 不预设任何角色层级，也不解释通配符权限。
  *
  * @example
  * ```ts
@@ -157,14 +160,7 @@ export function createFeatureGate(config: FeatureGateConfig): (user: FeatureGate
     }
 
     if (config.permissions && config.permissions.length > 0) {
-      const hasAll = config.permissions.every((permission) => {
-        if (user.permissions.includes("*")) return true;
-        if (user.permissions.includes(permission)) return true;
-        const [resource] = permission.split(":");
-        if (resource && user.permissions.includes(`${resource}:*`)) return true;
-        return false;
-      });
-      if (!hasAll) return false;
+      if (!config.permissions.every((permission) => user.permissions.includes(permission))) return false;
     }
 
     return true;

package/src/types.ts

@@ -334,6 +334,11 @@ export interface AuthProvider {
   logout: (params?: Record<string, unknown>) => Promise<AuthActionResult>;
   check: (params?: Record<string, unknown>) => Promise<CheckResult>;
   getIdentity: () => Promise<Identity | null>;
+  /**
+   * Returns UI-only permission hints for labels, navigation, or disabled controls.
+   * Browser-visible values are not authorization evidence: API, RLS, and action
+   * handlers must authenticate and authorize the request independently.
+   */
   getPermissions?: (params?: Record<string, unknown>) => Promise<unknown>;
   register?: (params: Record<string, unknown>) => Promise<AuthActionResult>;
   forgotPassword?: (params: Record<string, unknown>) => Promise<AuthActionResult>;