MechaCat02 61352c7e5e feat(authz): GroupDocsRead/GroupDocsWrite capabilities (§11.6 docs C2) ...

The shared-scope authz refinement for group docs collections — same trust shape
as the GroupKv* caps: GroupDocsRead = viewer+, GroupDocsWrite = editor+,
resolved via the group ancestor walk. Wired into app_id() (None),
required_scope() (ScriptRead/ScriptWrite), the Member→group_member_grants
route, and group_role_satisfies. Unit test mirrors the group-kv cap test.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-30 07:35:37 +02:00

..

abandoned_repo.rs

feat(v1.1.1-triggers): triggers + outbox schema + repos

2026-06-01 21:46:45 +02:00

admin_session_repo.rs

feat(manager-core): admin auth gate (Phase 3a)

2026-05-25 19:30:25 +02:00

admin_user_repo.rs

feat(manager-core,picloud): accept email on admin create + patch

2026-05-27 19:27:52 +02:00

admin_users_api.rs

fix(audit-2026-06-11/revocation-lag): evict PrincipalCache on credential change

2026-06-12 18:12:54 +02:00

api_key_repo.rs

style: cargo fmt across Phase 3.5 changes

2026-05-26 22:21:37 +02:00

api_keys_api.rs

fix(audit-2026-06-11/revocation-lag): evict PrincipalCache on credential change

2026-06-12 18:12:54 +02:00

api.rs

feat(scripts): group-owned script admin API + pic scripts … --group

2026-06-25 20:10:20 +02:00

app_bootstrap.rs

feat(scripts): polymorphic script owner (app XOR group) — Phase 4 foundation

2026-06-25 19:53:05 +02:00

app_domain_repo.rs

feat(manager-core,orchestrator-core): multi-app scoping (Phase 3b)

2026-05-25 21:03:05 +02:00

app_members_api.rs

fix(api): make app_members POST and PATCH atomic

2026-05-27 22:00:04 +02:00

app_members_repo.rs

feat(groups): tree repos, hierarchy-aware RBAC, admin API

2026-06-24 19:59:00 +02:00

app_repo.rs

feat(groups): tree repos, hierarchy-aware RBAC, admin API

2026-06-24 19:59:00 +02:00

app_secrets_repo.rs

fix(audit-2026-06-11/H-D1): bind AES-GCM AAD on secrets + realtime signing key

2026-06-12 17:15:09 +02:00

app_user_invitation_repo.rs

feat(v1.1.8): invitations flow (migration 0030 + accept_invite returns session)

2026-06-06 12:10:32 +02:00

app_user_password_reset_repo.rs

chore(v1.1.8): clippy --all-targets clean (F2)

2026-06-06 18:03:51 +02:00

app_user_repo.rs

fix(manager-core): F-P-012 keyset cursor on app_user_repo::list (created_at, id) tiebreaker

2026-06-07 20:50:25 +02:00

app_user_role_repo.rs

fix(manager-core): F-P-001 batch app_user_roles lookups in users::list (N+1 → 1)

2026-06-07 20:09:31 +02:00

app_user_session_repo.rs

feat(v1.1.8): app_user_sessions table + repo with sliding TTL

2026-06-05 23:17:24 +02:00

app_user_verification_repo.rs

feat(v1.1.8): email verification flow (migration 0028 + SDK)

2026-06-06 12:04:09 +02:00

apply_api.rs

feat(cli): collections manifest + ls + journeys; rename to kv::shared_collection (§11.6 C5)

2026-06-29 22:26:43 +02:00

apply_service.rs

feat(modules): group-docs schema + kind-generalized registry (§11.6 docs C1)

2026-06-30 07:33:39 +02:00

apps_api.rs

feat(groups): tree repos, hierarchy-aware RBAC, admin API

2026-06-24 19:59:00 +02:00

auth_api.rs

fix(audit-2026-06-11/H-B1 follow-up): use last X-Forwarded-For hop for login rate-limit key

2026-06-12 18:37:34 +02:00

auth_bootstrap.rs

feat(manager-core,picloud): accept email on admin create + patch

2026-05-27 19:27:52 +02:00

auth_middleware.rs

docs(audit-2026-06-11/tier3): fix stale principal_cache field comment

2026-06-12 19:08:31 +02:00

auth.rs

feat(v1.1.8): app_users table + repo (migration 0026)

2026-06-05 23:15:47 +02:00

authz.rs

feat(authz): GroupDocsRead/GroupDocsWrite capabilities (§11.6 docs C2)

2026-06-30 07:35:37 +02:00

config_api.rs

feat(secrets): group-secrets admin API, masked read, config/effective

2026-06-24 22:00:32 +02:00

config_resolver.rs

feat(modules): owner-aware module lookup — lexical chain walk (Phase 4b C1)

2026-06-26 07:07:04 +02:00

cron_scheduler.rs

feat(v1.1.4): outbound HTTP SDK + cron triggers

2026-06-03 20:23:18 +02:00

dead_letter_repo.rs

feat(v1.1.1-triggers): triggers + outbox schema + repos

2026-06-01 21:46:45 +02:00

dead_letter_service.rs

feat(v1.1.1-dead-letters): service + Rhai SDK + admin endpoints

2026-06-01 22:17:25 +02:00

dead_letters_api.rs

fix(admin-api): accept slug or UUID on per-app endpoints

2026-06-09 18:34:42 +02:00

dev_email_api.rs

feat: E2E #2 (Stash) gap remediation + S6 hardening

2026-06-13 15:01:04 +02:00

dispatcher.rs

feat(executor): thread the defining node into ExecRequest (Phase 4b C2)

2026-06-26 07:17:33 +02:00

docs_filter.rs

feat(v1.1.2-docs): manager-core docs service + repo + query DSL parser

2026-06-02 19:55:14 +02:00

docs_repo.rs

feat(modules): group-docs schema + kind-generalized registry (§11.6 docs C1)

2026-06-30 07:33:39 +02:00

docs_service.rs

fix(stage-3): queue DL fan-out + emit-failure visibility

2026-06-10 21:22:15 +02:00

email_inbound_api.rs

style: cargo fmt across audit-2026-06-11 tier-3 changes

2026-06-12 18:38:28 +02:00

email_service.rs

style(email): wrap over-width lines (cargo fmt)

2026-06-24 19:06:52 +02:00

extension_point_repo.rs

feat(modules): no-provider plan check + read-only extension-points ls (§5.5 C4)

2026-06-29 20:31:14 +02:00

files_api.rs

style: cargo fmt across audit-2026-06-11 tier-3 changes

2026-06-12 18:38:28 +02:00

files_repo.rs

fix(audit-2026-06-11/F-FS-002): belt-and-suspenders collection validation on files read/delete

2026-06-12 18:26:46 +02:00

files_service.rs

fix(audit-2026-06-11/C-2): file download attachment + nosniff + CSP + MIME allowlist

2026-06-11 20:24:55 +02:00

files_sweep.rs

feat(v1.1.6): realtime channels + v1.1.5 follow-ups + version bumps

2026-06-04 20:18:50 +02:00

gc.rs

chore(v1.1.8): GC sweep for app-user sessions + tokens

2026-06-06 15:02:21 +02:00

group_collection_repo.rs

feat(modules): group-docs schema + kind-generalized registry (§11.6 docs C1)

2026-06-30 07:33:39 +02:00

group_docs_repo.rs

feat(modules): group-docs schema + kind-generalized registry (§11.6 docs C1)

2026-06-30 07:33:39 +02:00

group_kv_repo.rs

feat(modules): group-collection registry + group-KV storage schema (§11.6 C1)

2026-06-29 21:30:42 +02:00

group_kv_service.rs

feat(modules): group-docs schema + kind-generalized registry (§11.6 docs C1)

2026-06-30 07:33:39 +02:00

group_members_repo.rs

feat(groups): tree repos, hierarchy-aware RBAC, admin API

2026-06-24 19:59:00 +02:00

group_repo.rs

feat(groups): tree repos, hierarchy-aware RBAC, admin API

2026-06-24 19:59:00 +02:00

group_scripts_api.rs

fix(modules): validate group module create per kind (Phase 4b review)

2026-06-29 19:32:34 +02:00

groups_api.rs

feat(groups): tree repos, hierarchy-aware RBAC, admin API

2026-06-24 19:59:00 +02:00

http_service.rs

fix(stage-1): audit High-severity backend correctness + CI unblocker

2026-06-10 21:03:10 +02:00

invoke_service.rs

feat(executor): thread the defining node into ExecRequest (Phase 4b C2)

2026-06-26 07:17:33 +02:00

kv_api.rs

feat: E2E #2 (Stash) gap remediation + S6 hardening

2026-06-13 15:01:04 +02:00

kv_repo.rs

feat(v1.1.1-kv): migrations + KvService trait + Postgres impl

2026-06-01 21:29:59 +02:00

kv_service.rs

fix(stage-3): queue DL fan-out + emit-failure visibility

2026-06-10 21:22:15 +02:00

lib.rs

feat(modules): group-docs schema + kind-generalized registry (§11.6 docs C1)

2026-06-30 07:33:39 +02:00

log_sink.rs

feat: E2E #2 (Stash) gap remediation + S6 hardening

2026-06-13 15:01:04 +02:00

login_rate_limit.rs

fix(audit-2026-06-11/H-B1): login rate limit + Argon2 concurrency cap

2026-06-11 20:42:51 +02:00

migrations.rs

feat: versioning scheme — lockstep crates + four independent surfaces

2026-05-23 00:31:08 +02:00

module_source.rs

feat(modules): extension-point-aware resolver policy (§5.5 C2)

2026-06-29 20:07:59 +02:00

outbox_event_emitter.rs

feat(v1.1.5): files SDK + files:* triggers

2026-06-03 21:18:17 +02:00

outbox_repo.rs

feat(v1.1.9): TriggerEvent::Queue + TriggerKind::Queue + types

2026-06-06 19:08:21 +02:00

principal_resolver.rs

feat(v1.1.1-dispatcher): dispatcher loop + retry + depth limit + outbox emitter

2026-06-01 22:01:42 +02:00

pubsub_repo.rs

feat(v1.1.5): pubsub::publish_durable SDK + pubsub:* triggers

2026-06-03 21:37:06 +02:00

pubsub_service.rs

fix(manager-core): F-S-001 cap kv/docs/pubsub/queue payload sizes (default 256 KB)

2026-06-07 20:00:36 +02:00

queue_repo.rs

fix(manager-core): F-P-006 cap queue::depth scans at 10k rows

2026-06-07 20:16:33 +02:00

queue_service.rs

fix(manager-core): F-S-001 cap kv/docs/pubsub/queue payload sizes (default 256 KB)

2026-06-07 20:00:36 +02:00

queues_api.rs

fix: post-review followups on slug-vs-UUID refactor

2026-06-09 20:03:10 +02:00

realtime_authority.rs

feat(sdk): users::email_available for anonymous registration pre-check (S1)

2026-06-12 20:43:18 +02:00

repo.rs

fix(apply): resolve inherited-bound triggers in diff, state-token, and prune

2026-06-25 21:11:59 +02:00

route_admin.rs

feat(scripts): polymorphic script owner (app XOR group) — Phase 4 foundation

2026-06-25 19:53:05 +02:00

route_repo.rs

feat(enabled): scripts/routes enabled column + declarative data path

2026-06-23 19:36:40 +02:00

sandbox.rs

feat: per-script Rhai sandbox overrides with admin ceiling

2026-05-23 16:26:12 +02:00

scheduler.rs

chore: initial scaffold — workspace, docs, blueprint

2026-05-22 23:16:32 +02:00

secrets_api.rs

feat(secrets): group-secrets admin API, masked read, config/effective

2026-06-24 22:00:32 +02:00

secrets_repo.rs

fix(secrets): composite keyset for group-secret admin list pagination

2026-06-24 22:13:00 +02:00

secrets_service.rs

feat(secrets): group-owned, env-scoped secrets + inherited resolution

2026-06-24 21:48:33 +02:00

ssrf.rs

feat(v1.1.4): outbound HTTP SDK + cron triggers

2026-06-03 20:23:18 +02:00

topic_repo.rs

feat(v1.1.8): F3 realtime auth_mode = 'session' (migration 0033)

2026-06-06 15:00:47 +02:00

topics_api.rs

feat(groups): tree repos, hierarchy-aware RBAC, admin API

2026-06-24 19:59:00 +02:00

trigger_config.rs

feat(v1.1.9): TriggerEvent::Queue + TriggerKind::Queue + types

2026-06-06 19:08:21 +02:00

trigger_repo.rs

fix(enabled): close disabled-script execution on the async paths (review)

2026-06-23 21:59:50 +02:00

triggers_api.rs

feat(scripts): inherited resolution for invoke() + chain-aware dispatch guards

2026-06-25 20:23:07 +02:00

users_admin_api.rs

fix(manager-core): F-P-012 keyset cursor on app_user_repo::list (created_at, id) tiebreaker

2026-06-07 20:50:25 +02:00

users_service.rs

fix(review): harden the E2E-gap fixes after security/regression review

2026-06-13 09:59:24 +02:00

vars_api.rs

feat(vars): admin CRUD API + pic vars CLI

2026-06-24 21:11:46 +02:00

vars_repo.rs

feat(vars): admin CRUD API + pic vars CLI

2026-06-24 21:11:46 +02:00

vars_service.rs

feat(vars): VarsService + vars:: SDK + config capabilities

2026-06-24 20:59:23 +02:00