[pikann]

Summary

Documentation-only update for the IAM authorization model. The Permissions helper now documents that Check takes an IAM action (<domain>:<verb>) and is decided by the host the same way the requireActions route middleware decides it.

No API or behavior change: Permissions.Check(string) bool, PermissionBackend and the paca.permission_check host import keep their signatures.

Changes

• backends.go: rewrite the Permissions and Permissions.Check doc comments. They described the removed flat permission keys and the requirePermissions middleware, and now describe IAM actions (built-in such as tasks:write, or plugin-declared such as time_logging:manage_all) and requireActions.
• wasm_imports.go: document that paca.permission_check takes an IAM action.
• plugintest/backends.go: the FakePermissions example uses time_logging:manage_all instead of the dotted form, so tests grant the same string the host checks.

Notes for plugin authors

Plugins calling Permissions.Check or FakePermissions.Grant must use the colon form (tasks:write, not tasks.write). The first-party plugins are updated in their own PRs (feat/iam-actions in each paca-plugin-* repo).

Testing

Comment-only change; the package builds unchanged.

🤖 Generated with Claude Code