lilleman
35f71d435b
Answer stability round 1: 0 🔴 , 2 🟡 (0 misread); tests pin all three user-page modes and the refusal page's group, the guard checks membership before the per-permission walk, logs the action and what was lost
2026-10-31 11:02:47 +01:00
lilleman
ad812e17c2
Refuse a group change that would lock the acting admin out, and title a read-only user page View user
CI / full-gate (push) Successful in 3m22s
2026-10-31 10:47:47 +01:00
lilleman
c1abc67a92
Answer prose round 1: 0 🔴 , 2 🟡 (0 misread); the harness and plugins-test comments and the README clause are gone, the admin pointers name the full path
2026-10-31 10:37:15 +01:00
lilleman
71b12a6c0a
Split src/http/app.test.ts into one file per concern, and reset the reading-cost trend
CI / full-gate (push) Successful in 3m20s
2026-10-31 10:35:08 +01:00
lilleman
65e2340e49
Answer stability round 1: 0 🔴 , 4 🟡 (0 misread); the serve path streams its hash and answers an unreadable file 500 with a log, cached deployments skip the per-href stat, tests for the pre-context error page and the size half of the memo
2026-10-31 10:25:19 +01:00
lilleman
c38ad74e3a
Answer prose round 1: 0 🔴 , 4 🟡 (0 misread); a changed file, not a release, changes the hash; the memo comment, the CHANGELOG scope and smaller comment cuts
2026-10-31 10:16:05 +01:00
lilleman
3d757d4726
item-34 - Serve every /public/ asset under a content-versioned URL with an immutable Cache-Control
2026-10-31 10:00:03 +01:00
lilleman
85bfadd040
Answer stability round 1: 1 🔴 , 4 🟡 (0 misread); allow the stale-save 409 in the e2e console guard, report a partial save when Keto cannot be read again, add the missing group, no-op and plain-login tests
2026-10-31 09:46:17 +01:00
lilleman
f4969d5c1f
Refuse a stale permission save, confirm or report it, show View to read-only holders, keep an absolute return_to beside a locale
CI / full-gate (push) Failing after 2m53s
2026-10-31 09:34:05 +01:00
lilleman
8d1e8be6fc
Answer stability round 1: 0 🔴 , 2 🟡 (0 misread); pin the 503 on a non-401 failure and the language-only return target
2026-10-31 09:10:57 +01:00
lilleman
2a4ed30e93
Redirect an anonymous hit on /settings to sign-in with the page as return_to
CI / full-gate (push) Successful in 3m25s
2026-10-31 09:04:55 +01:00
lilleman
437a2e8580
Answer stability round 1: 0 🔴 , 3 🟡 (0 misread); pin dashboard heading and branding, fix stale comment
2026-10-31 08:41:59 +01:00
lilleman
352de29013
Retire shell-context and render the dashboard from ctx.chrome
CI / full-gate (push) Successful in 3m18s
2026-10-31 08:37:45 +01:00
lilleman
44a777dc3f
Answer stability round 1: 1 🔴 , 0 🟡 (0 misread); share no page
2026-10-30 21:32:56 +01:00
lilleman
1dfc6aac3a
Set Cache-Control on every rendered page, and record the CSRF token's unbinding
CI / full-gate (push) Successful in 3m23s
2026-10-30 21:28:14 +01:00
lilleman
18dc4f3136
Refuse an emailless identity where the session is minted, and rows the upstream should not have sent
CI / full-gate (push) Successful in 2m53s
2026-09-02 18:24:56 +02:00
lilleman
6a0d11d9d3
Name exactly one gate on every declaration, and own a shift by identity id
2026-09-02 14:00:04 +02:00
lilleman
dfb043c3bd
Read one gate everywhere, and check a declaration's gate in one pass
2026-09-02 12:32:51 +02:00
lilleman
bf146c07e7
Bump the contract for the new gate, and close the ways it could read as open
CI / full-gate (push) Successful in 2m45s
2026-09-02 08:36:16 +02:00
lilleman
8da75b4ca7
Gate a route or nav node on a session, not only a permission
CI / full-gate (push) Successful in 3m6s
2026-09-02 07:36:08 +02:00
lilleman
fa7cad1d65
Declare plugin settings in the manifest, resolve them from the environment
2026-08-23 13:17:03 +02:00
lilleman
cb59eee76d
Refuse a node_modules at the plugins/ root, where it outranks the host's
2026-08-18 08:14:21 +02:00
lilleman
af974cfa36
Let a plugin carry its own package.json and npm dependencies
2026-08-17 22:23:53 +02:00
lilleman
a005acb93d
Cut non-essential prose from docs and comments, and require the same of every future change
...
CI / full-gate (push) Successful in 2m38s
README loses the competitor comparison, the personas and the repeated philosophy; the
five near-identical E2E command blocks become a table plus one command, and the file
map a clause per entry. AGENTS.md keeps every decision but drops the narrative around
them. todo.md's completed items collapse to their task line — git holds the rest.
Comments lose restatement, README duplication and history ("used to", "originally",
dated notes). AGENTS.md gains a Prose discipline section making this a standing pass on
every change rather than a one-off cleanup.
src/compose.test.ts now expects 6 documented E2E run commands, not 10, since the README
states the command once instead of per suite.
2026-08-05 23:41:12 +02:00
lilleman
edcd9fefc8
Deleting a group revokes the permissions it granted
2026-08-05 15:39:08 +02:00
lilleman
1787754781
Extend the read-only treatment to OAuth2 clients and write-intent GETs
2026-08-05 15:38:56 +02:00
lilleman
765f349007
Model the read/write split in the UI: read-only views, self-revoke and inherited-grant guards
2026-08-05 15:38:37 +02:00
lilleman
29d654c012
Permissions are a fixed list from plugin code; grant them on Users and Groups
2026-08-05 15:38:21 +02:00
lilleman
27fee5f8a3
Permission names are <resource>:<action>, replacing the catch-all admin permission
2026-08-05 15:37:39 +02:00
lilleman
bd76c981ee
Carry the language through sign-in; warn when switching leaves the page; product-review copy fixes
CI / full-gate (push) Successful in 2m40s
2026-08-04 09:59:00 +02:00
lilleman
37b88b2fe6
Show the language picker on every page, targeting the nearest page that answers GET
CI / full-gate (push) Successful in 2m39s
2026-08-04 09:37:03 +02:00
lilleman
18e1a8d29d
Keep the chrome lazy for error pages, guard the guard-error render, split the recovery link
CI / full-gate (push) Successful in 2m38s
2026-08-04 00:31:19 +02:00
lilleman
93139ea058
Stability round two: no language links on POST-rendered pages, scoped observers, Vary only where it varies
CI / full-gate (push) Successful in 2m37s
2026-08-04 00:10:31 +02:00
lilleman
be3bc2bdbb
Stability fixes: plugin-scoped contexts for owned pages, absent-href guard, checked locale mounts
CI / full-gate (push) Successful in 2m37s
2026-08-03 23:51:40 +02:00
lilleman
6440c543e5
Architecture review fixes: partials carry the locale, mountable locales/, shared core words
CI / full-gate (push) Successful in 2m36s
2026-08-03 23:12:18 +02:00
lilleman
245d1ad5b5
Add i18n support: per-locale catalogs, URL-driven locale, translated core and examples
CI / full-gate (push) Successful in 2m37s
2026-08-03 22:37:27 +02:00
lilleman
f38b5373bd
Say user throughout, noting Ory's identity naming in the docs
2026-08-03 17:41:40 +02:00
lilleman
096720904e
Rename the coarse gate from role to permission, matching RBAC
2026-08-03 17:41:40 +02:00
lilleman
3486e0ad00
Rename the Keto User namespace to Identity, matching Kratos
2026-08-03 17:41:40 +02:00
lilleman
b580f7d06e
Rename the plugin-API permission gate to role
2026-08-03 17:41:40 +02:00
lilleman
6f6aafad39
Import ejs as default export — the v6 ESM build exports only default
CI / full-gate (push) Successful in 2m52s
Mirror / github-mirror (push) Successful in 6s
2026-08-02 15:25:51 +02:00
lilleman
535902e69b
Split handleRequest into pipeline + internal route table; auth/OAuth2 endpoints become named handlers in src/auth/routes.ts
2026-07-02 13:05:54 +02:00
lilleman
e8ea911b80
Move admin screens (users/groups/roles/oauth2-clients) into a drop-in example plugin; add the ctx.system capability surface
2026-07-02 08:01:15 +02:00
lilleman
d8cf257940
Move plugin-contract.md into README's Building plugins section; remove docs/, repoint all references
2026-06-26 23:12:40 +02:00
lilleman
de22f51c12
Organize src/ into concern folders (http, auth, admin, plugin-host, ui); co-locate tests, move plugin-api barrel into plugin-host, sync docs + AGENTS layout
2026-06-24 00:23:55 +02:00
lilleman