feat: add flexible capability-based RBAC with per-tenant customization #14

JoeBot · 2026-04-06T16:13:12-04:00

JoeBot commented

2026-04-06 16:13:12 -04:00

Introduces a capability layer on top of existing roles that controls
feature visibility and access. Capabilities follow an area.feature.action
taxonomy (~35 capabilities) with sensible defaults per role. Tenant admins
can customize via grant/revoke overrides stored in org settings JSONB.

Key changes:

Add vice_president role to DB schema
Backend: capability constants, resolution logic, CapabilityGuard (global),
@RequireCapability decorator on all 16 tenant controllers
Frontend: permission hooks (useCanEdit, useHasCapability), CapabilityGate
component, sidebar filtering by capability, all 17 pages migrated from
useIsReadOnly to capability-based checks
New admin UI: /settings/permissions matrix page for per-tenant role
customization with grant/revoke delta model
GET /organizations/my-capabilities endpoint for capability refresh
Validation of permissionOverrides in settings updates

Co-Authored-By: Claude Opus 4.6 noreply@anthropic.com

Introduces a capability layer on top of existing roles that controls feature visibility and access. Capabilities follow an area.feature.action taxonomy (~35 capabilities) with sensible defaults per role. Tenant admins can customize via grant/revoke overrides stored in org settings JSONB. Key changes: - Add vice_president role to DB schema - Backend: capability constants, resolution logic, CapabilityGuard (global), @RequireCapability decorator on all 16 tenant controllers - Frontend: permission hooks (useCanEdit, useHasCapability), CapabilityGate component, sidebar filtering by capability, all 17 pages migrated from useIsReadOnly to capability-based checks - New admin UI: /settings/permissions matrix page for per-tenant role customization with grant/revoke delta model - GET /organizations/my-capabilities endpoint for capability refresh - Validation of permissionOverrides in settings updates Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

JoeBot added 1 commit 2026-04-06 16:13:12 -04:00

feat: add flexible capability-based RBAC with per-tenant customization 43b10869f0

Introduces a capability layer on top of existing roles that controls
feature visibility and access. Capabilities follow an area.feature.action
taxonomy (~35 capabilities) with sensible defaults per role. Tenant admins
can customize via grant/revoke overrides stored in org settings JSONB.

Key changes:
- Add vice_president role to DB schema
- Backend: capability constants, resolution logic, CapabilityGuard (global),
  @RequireCapability decorator on all 16 tenant controllers
- Frontend: permission hooks (useCanEdit, useHasCapability), CapabilityGate
  component, sidebar filtering by capability, all 17 pages migrated from
  useIsReadOnly to capability-based checks
- New admin UI: /settings/permissions matrix page for per-tenant role
  customization with grant/revoke delta model
- GET /organizations/my-capabilities endpoint for capability refresh
- Validation of permissionOverrides in settings updates

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

JoeBot added 1 commit 2026-04-06 16:13:20 -04:00

Merge branch 'main' into feature-rbac c57dd3e155

JoeBot merged commit 83115c9b5c into main

2026-04-06 16:13:27 -04:00

JoeBot deleted branch feature-rbac

2026-04-06 16:13:27 -04:00

JoeBot referenced this issue from a commit

2026-04-06 16:13:29 -04:00

Merge pull request 'feat: add flexible capability-based RBAC with per-tenant customization' (#14) from feature-rbac into main

Sign in to join this conversation.