ekklesia
d9dd409aa3
Establishes the one canonical PermissionDeclaration contract (packages/contracts/src/authorization.ts) — id/baseline/description, strict, unknown-property-rejecting — consumed by both Core's authorization registry and module manifests, replacing Core's previously separate interface. Bumps the canonical module manifest to manifestVersion 3: permissions become complete declarations instead of bare identifier strings, with manifest-owned namespace and duplicate-id enforcement. Version 2 and bare string-array permissions are rejected outright; there is no compatibility adapter. Adds composePlatformPermissionRegistry (core/src/modules/permissions.ts), a pure, synchronous composer that builds one platform permission registry from Core's own declarations plus every already-discovered module's, in deterministic order, reusing createPermissionRegistry and rejecting any module-contributed permission in the reserved core.* namespace. core/src/authorization remains independent of core/src/modules; only the module integration layer depends on authorization. Updates the module template, module-development docs, authorization docs, and existing manifest fixtures for manifestVersion 3. Does not wire the combined registry into apps/api — that is pass 2.
38 lines
774 B
JSON
38 lines
774 B
JSON
{
|
|
"manifestVersion": 3,
|
|
"id": "example",
|
|
"name": "Example Module",
|
|
"description": "A minimal backend-only Ekklesia module template.",
|
|
"version": "0.1.0",
|
|
"compatibility": {
|
|
"platform": "^0.1.0",
|
|
"moduleSdk": "^0.1.0"
|
|
},
|
|
"capabilities": [
|
|
{
|
|
"id": "example.records",
|
|
"version": "1.0.0"
|
|
}
|
|
],
|
|
"permissions": [
|
|
{
|
|
"id": "example.records.read",
|
|
"baseline": "restricted",
|
|
"description": "Read example records."
|
|
}
|
|
],
|
|
"storage": {
|
|
"buckets": [
|
|
{
|
|
"id": "records",
|
|
"description": "Private objects owned by this example module."
|
|
}
|
|
]
|
|
},
|
|
"entrypoints": {
|
|
"server": "./dist/server/index.js",
|
|
"schema": "./dist/schema/index.js",
|
|
"migrations": "./drizzle"
|
|
}
|
|
}
|