Goutam/LynkedUpPro_CRM
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(plan8): frame ABAC layer as cosmetic frontend-only (real enforcement is backend, another team)

Browse Source
This commit is contained in:
Satyam Rastogi
2026-05-29 21:35:18 +05:30
parent d68c63d716
commit 2946369199
2 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/superpowers/2026-05-29-MASTER-PLAN.md
+1 -1
View File
@@ -534,4 +534,4 @@ Each plan = one phase, produces working/verifiable software on its own, and is e
- **What:** an attribute-based policy engine (subject/resource/action/context attributes; ordered permit/deny; deny-wins; default-deny) generalizing the role/override data; `can(action, resource, ctx)` API; a permission-aware route guard; the Option-B unified route scheme (one human-readable route per feature, role landings only); nav hiding + styled Access Restricted page; Org Settings as policy/attribute editor.
- **Why:** ABAC expresses ownership/assignment/territory rules RBAC can't (a rep edits only their projects; a sub sees only theirs) while still covering the simple "deny one admin / one agent read-only" asks — a credible enterprise-access story; folded with the route cleanup it also yields one obvious URL per feature.
- **How:** a pure engine in `src/data/abac.js` (`evaluate` deny-wins/default-deny + `compilePolicies` folding the matrix + per-person overrides + resource-aware rules); `usePermissions` keeps `can(module,action)` (engine-backed, back-compatible) and adds resource-aware `canAccess(action, resource)`; a module-gated `ProtectedRoute` + Access Restricted page; resource gates on project detail; nav permission-hiding; then (separately, higher-risk) **consolidate `App.jsx`** to unified routes (with redirects from legacy paths) and strip `basePath` from 4 files. The friendly Org-Settings matrix already configures the engine (no new policy editor). **Phased so the ABAC core (low-risk wow) is shippable before the route-URL consolidation, which is deferrable.** Verify: rep blocked from editing a project they're not on; sub sees only theirs; denied direct-URL → Access Restricted; (Phase C) one route per feature, no `basePath` left.
- **Plan file:** `docs/superpowers/plans/2026-05-29-plan8-abac-routing.md`. **Note:** plan keeps `can(module,action)` + adds `canAccess(action,resource)` (rather than replacing the signature) to avoid breaking existing callers; ABAC engine lives in `src/data/abac.js` (not `utils/permissions.js`).
- **Plan file:** `docs/superpowers/plans/2026-05-29-plan8-abac-routing.md`. **Note:** plan keeps `can(module,action)` + adds `canAccess(action,resource)` (rather than replacing the signature) to avoid breaking existing callers; ABAC engine lives in `src/data/abac.js` (not `utils/permissions.js`). **Cosmetic/frontend-only** — a client-side demonstration of the access model against the mock store; real enforcement is backend (another team), so no auth/session/server policy plumbing.