No description

jtricerolph dfa6718cb5 Fix Staff role cashup permission resets: seed once, not on empty-caps guess ... Several 'grant Staff these default caps' seeds in initDb() re-ran on every auth container restart, guarded by 'role currently has no caps for this app' as a proxy for 'first deploy'. If an admin revoked all of Staff's cashup capabilities in the portal, the next restart saw zero cashup caps and silently re-granted all 7 non-settings caps back — looking like permissions randomly resetting to full access. Add a seed_flags table + seedOnce() helper so these default-cap grants (cashup x2, hk-planner, kds, tasks) run exactly once ever, tracked by a durable flag instead of re-derived from current state. Deliberate permission changes now stick across restarts/redeploys. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>		2026-08-31 12:58:02 +00:00
src	Fix Staff role cashup permission resets: seed once, not on empty-caps guess	2026-08-31 12:58:02 +00:00
.env.example	Add internal registry endpoint, self-registration, and workforce sync	2026-07-01 20:35:44 +00:00
.gitignore	Initial commit: auth	2026-07-01 12:09:54 +00:00
docker-compose.yml	Add SETTINGS_URL/SECRET to compose, fix sync email-change and rate-limit bugs	2026-07-02 00:23:59 +00:00
Dockerfile	Initial commit: auth	2026-07-01 12:09:54 +00:00
package.json	Add internal registry endpoint, self-registration, and workforce sync	2026-07-01 20:35:44 +00:00