No description

jtricerolph c7f7079b99 Add per-app granular capabilities (RBAC beyond app access) ... Schema: - app_capabilities: capabilities each app exposes (<app>:<slug>) - role_capabilities / user_capabilities: grants via roles and direct - Seed cashup caps (count, finalise, reports, floats, settings) - Non-breaking migration: default Staff role gets all cashup caps except settings (previously only is_admin reached settings) Resolution: - getUserCapabilities(): admins get all; others get union of role + direct grants, as "<app>:<cap>" strings - caps[] added to JWT payload (login + register) - /verify returns live capabilities for the requested app (bare slugs) Admin API: - GET /admin/capabilities catalogue - grant/revoke capability on roles and users - roles/users GET responses now include their capabilities Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>		2026-07-02 14:19:08 +00:00
src	Add per-app granular capabilities (RBAC beyond app access)	2026-07-02 14:19:08 +00:00
.env.example	Add internal registry endpoint, self-registration, and workforce sync	2026-07-01 20:35:44 +00:00
.gitignore	Initial commit: auth	2026-07-01 12:09:54 +00:00
docker-compose.yml	Add SETTINGS_URL/SECRET to compose, fix sync email-change and rate-limit bugs	2026-07-02 00:23:59 +00:00
Dockerfile	Initial commit: auth	2026-07-01 12:09:54 +00:00
package.json	Add internal registry endpoint, self-registration, and workforce sync	2026-07-01 20:35:44 +00:00