Goutam/LynkedUpPro_CRM
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: add Plan 8 (ABAC access control + unified routing); phased core-vs-routing

Browse Source
This commit is contained in:
Satyam Rastogi
2026-05-29 21:33:24 +05:30
parent adfe44426c
commit d68c63d716
2 changed files with 310 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/superpowers/2026-05-29-MASTER-PLAN.md
+2 -1
View File
@@ -533,4 +533,5 @@ Each plan = one phase, produces working/verifiable software on its own, and is e
### Plan 8 — ABAC access control + unified routing
- **What:** an attribute-based policy engine (subject/resource/action/context attributes; ordered permit/deny; deny-wins; default-deny) generalizing the role/override data; `can(action, resource, ctx)` API; a permission-aware route guard; the Option-B unified route scheme (one human-readable route per feature, role landings only); nav hiding + styled Access Restricted page; Org Settings as policy/attribute editor.
- **Why:** ABAC expresses ownership/assignment/territory rules RBAC can't (a rep edits only their projects; a sub sees only theirs) while still covering the simple "deny one admin / one agent read-only" asks — a credible enterprise-access story; folded with the route cleanup it also yields one obvious URL per feature.
- **How:** define attributes + a policy evaluator in `src/utils/permissions.js` (+ a policies data source); extend `usePermissions` to resource-aware `can`; add a route-guard component; **consolidate `App.jsx`** to unified routes and strip `basePath` across components (the largest cross-file change — sequence carefully, lane-map per file); add the Access Restricted page; make `Layout` hide denied nav; update Org Settings. Verify: resource-aware decisions (rep blocked from a project they're not on; sub sees only their projects); denied direct-URL → Access Restricted; one route per feature; no `basePath` left.
- **How:** a pure engine in `src/data/abac.js` (`evaluate` deny-wins/default-deny + `compilePolicies` folding the matrix + per-person overrides + resource-aware rules); `usePermissions` keeps `can(module,action)` (engine-backed, back-compatible) and adds resource-aware `canAccess(action, resource)`; a module-gated `ProtectedRoute` + Access Restricted page; resource gates on project detail; nav permission-hiding; then (separately, higher-risk) **consolidate `App.jsx`** to unified routes (with redirects from legacy paths) and strip `basePath` from 4 files. The friendly Org-Settings matrix already configures the engine (no new policy editor). **Phased so the ABAC core (low-risk wow) is shippable before the route-URL consolidation, which is deferrable.** Verify: rep blocked from editing a project they're not on; sub sees only theirs; denied direct-URL → Access Restricted; (Phase C) one route per feature, no `basePath` left.
- **Plan file:** `docs/superpowers/plans/2026-05-29-plan8-abac-routing.md`. **Note:** plan keeps `can(module,action)` + adds `canAccess(action,resource)` (rather than replacing the signature) to avoid breaking existing callers; ABAC engine lives in `src/data/abac.js` (not `utils/permissions.js`).