Permission names are <resource>:<action>, replacing the catch-all admin permission

2026-08-05 12:45:06 +02:00
parent 225569b08a
commit 065d865d24
23 changed files with 388 additions and 180 deletions
@@ -30,6 +30,13 @@ services:
      timeout: 4s
      retries: 30

+  # This stack mounts no plugins, so nothing declares a permission for the bootstrap to seed — and
+  # the suite asserts that Keto's grants reach the JWT claim. Name one explicitly so there is
+  # something to project.
+  bootstrap:
+    environment:
+      ADMIN_PERMISSIONS: users:read
+
  # Shorten the session→JWT TTL and expose a network-resolvable base_url (ory/kratos/e2e.yml),
  # merged after the base config.
  kratos: