lilleman
18dc4f3136
Refuse an emailless identity where the session is minted, and rows the upstream should not have sent
CI / full-gate (push) Successful in 2m53s
2026-09-02 18:24:56 +02:00
lilleman
6a0d11d9d3
Name exactly one gate on every declaration, and own a shift by identity id
2026-09-02 14:00:04 +02:00
lilleman
dfb043c3bd
Read one gate everywhere, and check a declaration's gate in one pass
2026-09-02 12:32:51 +02:00
lilleman
bf146c07e7
Bump the contract for the new gate, and close the ways it could read as open
CI / full-gate (push) Successful in 2m45s
2026-09-02 08:36:16 +02:00
lilleman
c7e6d66750
Scope My shifts at the upstream, and give Route and NavNode one gate declaration
CI / full-gate (push) Successful in 2m56s
2026-09-02 08:15:08 +02:00
lilleman
8da75b4ca7
Gate a route or nav node on a session, not only a permission
CI / full-gate (push) Successful in 3m6s
2026-09-02 07:36:08 +02:00
lilleman
e0046e5068
Warn rather than refuse on a storage URL mismatch, and scrub the provisioning DSN before discovery
2026-08-19 01:03:40 +02:00
lilleman
5589472e25
Keep role re-assertion within a non-superuser provisioner's rights, and test the second boot
2026-08-19 00:44:49 +02:00
lilleman
e66a8a3e89
Isolate the storage CI stack, prove least-privilege provisioning, drop the secret before discovery
2026-08-19 00:20:17 +02:00
lilleman
060535c8ab
Confine the Postgres driver to bootstrap, bound plugin connections, and gate the storage DDL
2026-08-19 00:08:35 +02:00
lilleman
c7013be2f0
Give a plugin a Postgres database of its own
2026-08-18 23:12:13 +02:00
lilleman
8f3fc7414a
Hint the code field's digits-only rule, so the browser's refusal isn't bare
2026-08-18 22:07:12 +02:00
lilleman
a005acb93d
Cut non-essential prose from docs and comments, and require the same of every future change
...
CI / full-gate (push) Successful in 2m38s
README loses the competitor comparison, the personas and the repeated philosophy; the
five near-identical E2E command blocks become a table plus one command, and the file
map a clause per entry. AGENTS.md keeps every decision but drops the narrative around
them. todo.md's completed items collapse to their task line — git holds the rest.
Comments lose restatement, README duplication and history ("used to", "originally",
dated notes). AGENTS.md gains a Prose discipline section making this a standing pass on
every change rather than a one-off cleanup.
src/compose.test.ts now expects 6 documented E2E run commands, not 10, since the README
states the command once instead of per suite.
2026-08-05 23:41:12 +02:00
lilleman
38ebe40398
Never fail the boot on operator env; drop unusable ADMIN_PERMISSIONS with a warning
CI / full-gate (push) Successful in 2m40s
2026-08-05 17:36:04 +02:00
lilleman
765f349007
Model the read/write split in the UI: read-only views, self-revoke and inherited-grant guards
2026-08-05 15:38:37 +02:00
lilleman
27fee5f8a3
Permission names are <resource>:<action>, replacing the catch-all admin permission
2026-08-05 15:37:39 +02:00
lilleman
34b668d49f
Use one verb per action in the English UI: sign in, sign out, create account
CI / full-gate (push) Successful in 2m39s
2026-08-05 00:34:05 +02:00
lilleman
bd76c981ee
Carry the language through sign-in; warn when switching leaves the page; product-review copy fixes
CI / full-gate (push) Successful in 2m40s
2026-08-04 09:59:00 +02:00
lilleman
245d1ad5b5
Add i18n support: per-locale catalogs, URL-driven locale, translated core and examples
CI / full-gate (push) Successful in 2m37s
2026-08-03 22:37:27 +02:00
lilleman
f38b5373bd
Say user throughout, noting Ory's identity naming in the docs
2026-08-03 17:41:40 +02:00
lilleman
096720904e
Rename the coarse gate from role to permission, matching RBAC
2026-08-03 17:41:40 +02:00
lilleman
3486e0ad00
Rename the Keto User namespace to Identity, matching Kratos
2026-08-03 17:41:40 +02:00
lilleman
8f9f79ac30
Document the users, groups and roles model in README
2026-08-03 17:41:40 +02:00
lilleman
b580f7d06e
Rename the plugin-API permission gate to role
2026-08-03 17:41:40 +02:00
lilleman
5a5803b265
Review fixes: denylist-conditional revoke, Ory secret wiring, exp guard test
2026-08-03 17:41:40 +02:00
lilleman
535902e69b
Split handleRequest into pipeline + internal route table; auth/OAuth2 endpoints become named handlers in src/auth/routes.ts
2026-07-02 13:05:54 +02:00
lilleman
de22f51c12
Organize src/ into concern folders (http, auth, admin, plugin-host, ui); co-locate tests, move plugin-api barrel into plugin-host, sync docs + AGENTS layout
2026-06-24 00:23:55 +02:00
lilleman