From 0b2046a8d3ca4722620ca4319e3c9f4618ba0431 Mon Sep 17 00:00:00 2001 From: zumbrunn Date: Mon, 31 Aug 2026 00:10:04 +0200 Subject: [PATCH 1/2] docs(auth): granular admin permissions go through authz.check() ROLE_PERMISSIONS is gone; missing authz fails closed. Co-authored-by: Cursor --- 17.authentication/03.authorization/default.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/17.authentication/03.authorization/default.md b/17.authentication/03.authorization/default.md index cd4c04f..6c36456 100644 --- a/17.authentication/03.authorization/default.md +++ b/17.authentication/03.authorization/default.md @@ -235,11 +235,11 @@ editor → tuple: (user:bob, editor, app:admin) author → tuple: (user:carol, author, app:admin) ``` -The admin panel middleware enforces panel access via `authz.check()` when authz is wired. Role changes and user deletes via the admin API automatically sync the tuple store. +The admin panel middleware enforces panel access via `authz.check()`. If `authz` is undefined (creation failed at startup), the gate fails closed (403). Role changes and user deletes via the admin API automatically sync the tuple store. -**Granular admin permission checks** (`pages.create`, `config.read`, etc.) still use the flat `ROLE_PERMISSIONS` model — full polizy migration for those is tracked in the later roadmap. +**Granular admin permission checks** (`pages.create`, `config.read`, etc.) use the same `authz.check()` against `{ type: "app", id: "admin" }`, mapped through the canonical `actionToRelations` schema. There is no parallel role table. ## Limitations - `authzStore: local` is single-process only. Multi-process deployments should use a shared database (future `authzStore: db`). -- Granular admin permissions (`pages.create`, `config.read`, etc.) — not yet through polizy. `ROLE_PERMISSIONS` remains the authority for those. +- The published synchronous hook `ResponseTransformContext.auth.hasPermission()` is a role-only approximation of that schema (`roleHasPermission()`). Use `authz.check()` for access decisions. From cec6c16b1e80e2b45765ec5810f7feda8cf497b6 Mon Sep 17 00:00:00 2001 From: zumbrunn Date: Mon, 31 Aug 2026 00:53:22 +0200 Subject: [PATCH 2/2] docs(auth): drop removed users.manage from authz action table MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit users.manage was removed from core's polizy schema (it was dead — never referenced, not in AdminPermission or ROLE_PERMISSIONS). Point the sample row at users.update instead. Also add the missing author relation to pages.update to match the current schema (["admin", "editor", "author"]). Co-Authored-By: Claude Sonnet 5 --- 17.authentication/03.authorization/default.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/17.authentication/03.authorization/default.md b/17.authentication/03.authorization/default.md index 6c36456..e3286e6 100644 --- a/17.authentication/03.authorization/default.md +++ b/17.authentication/03.authorization/default.md @@ -36,8 +36,8 @@ Dune's default schema defines: |--------|-------------| | `access` | member, admin, editor, author | | `edit` | owner, admin, editor | -| `pages.update` | admin, editor | -| `users.manage` | admin | +| `pages.update` | admin, editor, author | +| `users.update` | admin | | `media.upload` | admin, editor, author | ## Config