docs(permissions),feat(setup-nav): standalone explain/matrix/delegated-admin pages, last "Roles" label → Positions, objectui pin bump#2759
Merged
Conversation
…d-admin pages + the last "Roles" label + objectui pin bump
Docs: the three ADR-0090 P3/P4 capabilities folded into authorization.mdx
get standalone, runbook-grade pages — explain.mdx (service + REST contract,
layer vocabulary, D12 caller authorization), access-matrix.mdx (opt-in,
real drift-failure output, snapshot format, review workflow), and
delegated-administration.mdx (adminScope reference, the nine runtime gate
rules — each proven by the showcase permission-zoo dogfood — and the
assignment BU anchor). meta.json ordering + cross-links from the
summaries that remain in place.
Setup nav: the sys_position entry sheds the last "role" in platform UI
copy (ADR-0090 D3) — nav_roles/"Roles" → nav_positions/"Positions"
(岗位/ポジション/Posiciones across the four translation bundles).
.objectui-sha → 397dcad73eaf: picks up the Studio Access-pillar explain
panel ("why can this user access?", ADR-0090 D6, objectui#2375) and the
suggested audience-binding install prompt (D5/D9, objectui#2376).
Browser-verified against the rebuilt vendored console on a fresh boot:
Setup sidebar shows 岗位; the Access pillar's 权限矩阵 renders all 8 zoo
sets with per-object OWD + Ext dials; the 解释访问权限 panel returns the
full layered decision (allowed banner, principal card, per-layer verdicts
with contributor attribution) through the new REST endpoint.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
…15f0bbe) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
github-actions
Bot
added
documentation
Contributor
📓 Docs Drift CheckThis PR changes 2 package(s): 12 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-ups to the ADR-0090 zoo/fix series (#2739, #2745), rounding out the remaining suggestions.
Standalone permission docs
The three P3/P4 capabilities previously folded into
authorization.mdxget dedicated, runbook-grade pages (structural — the summaries stay in place and now link out):permissions/explain.mdx— decision anatomy (layers, verdicts, contributor attribution with a real showcase example), service +GET/POST /api/v1/security/explainusage, the D12 caller-authorization rule, and what the engine powers.permissions/access-matrix.mdx— opt-in via committedaccess-matrix.json, the REAL drift-failure output (captured live: "'showcase_member_default' gains access to 'showcase_private_note' (create, read, edit)"), snapshot format, and how the gate composes with the D7 linter and explain.permissions/delegated-administration.mdx—adminScopefield reference, the nine runtime gate rules in one table (each proven end-to-end byshowcase-permission-zoo.dogfood.test.ts), the assignment BU anchor, and the explain tie-in.meta.jsongains the three pages;apps/docsproduction build green.The last "Roles" in platform UI copy (ADR-0090 D3)
plugin-security's Setup nav contribution renamed
nav_roles/"Roles" →nav_positions/"Positions", with the four platform-objects translation bundles following (岗位 / ポジション / Posiciones). This was the label the Setup sidebar still showed next to the (already-renamed) 岗位 object page.objectui pin bump →
397dcad73eafPicks up two ADR-0090 UI deliverables that landed in objectui: the Studio Access-pillar "why can this user access?" explain panel (D6, objectui#2375) and the suggested audience-binding install prompt (D5/D9, objectui#2376). Portal metadata has no
profilesconsumer in objectui (verified) — nothing to migrate there.Verification
build-console.sh, bundle canary ✓) and browser-verified on a fresh--ui --seed-adminboot:client_portal_user+ built-ins + everyone/guest).Related: #2696 (explain tracking), ADR-0090 D3/D5/D6/D9/D12.
🤖 Generated with Claude Code