From 1773c2737fec8aab052fa78fdad819b3a24f0706 Mon Sep 17 00:00:00 2001 From: Lilleman auf Larv Date: Mon, 9 Nov 2026 00:14:53 +0100 Subject: [PATCH] =?UTF-8?q?Answer=20product-owner=20round=201:=200=20?= =?UTF-8?q?=F0=9F=94=B4,=201=20=F0=9F=9F=A1=20(0=20misread);=20list=20plug?= =?UTF-8?q?in-settings=20among=20the=20Admin=20resources?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- README.md | 4 ++-- examples/plugins/auth-admin/README.md | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index 6435fef..6c72473 100644 --- a/README.md +++ b/README.md @@ -347,8 +347,8 @@ curl -X PUT http://keto:4467/admin/relation-tuples -H 'content-type: application **A permission's name is authored in plugin code; only its *grants* live in Keto.** A plugin declares the permissions it gates on (`permissions:` in the manifest) and the host collects them into one catalog — `ctx.declaredPermissions` — which is the fixed list the admin screens offer. -Nothing in a GUI invents a name; a tuple naming something no installed plugin declares is not -offered by the admin screens, though a plugin may still gate on it. +Nothing in a GUI invents a name. A grant of a name that no installed plugin declares still reaches +the user's JWT, so a plugin may gate on that name without declaring it. A change takes effect on the user's **next login or JWT re-mint** (~10 min) — see [Instant revoke](#instant-revoke-the-optional-denylist) when you need it sooner. diff --git a/examples/plugins/auth-admin/README.md b/examples/plugins/auth-admin/README.md index a33b48e..a5c0135 100644 --- a/examples/plugins/auth-admin/README.md +++ b/examples/plugins/auth-admin/README.md @@ -35,9 +35,9 @@ screen degrades to a themed 503 rather than crashing. Everything else is an ordi folder-discovered, gated per route by its screen's `:` permission, rendering the core building blocks in `views/`. -Each screen is its own resource — `users`, `groups`, `oauth2-clients` — split into `:read` and -`:write`, so a helpdesk account can be given `users:read` alone. Holding none of the six hides the -Admin section entirely. +Each screen is its own resource — `users`, `groups`, `oauth2-clients`, `plugin-settings` — split +into `:read` and `:write` (`plugin-settings` has only `:read`), so a helpdesk account can be given +`users:read` alone. Holding none of the seven hides the Admin section entirely. There is **no Permissions screen**. Permission names are declared in plugin code, not created in a GUI, so the host's catalog (`ctx.declaredPermissions`) is the fixed list — and holding one is a