Merged
Conversation
Owner
Author
This stack of pull requests is managed by Graphite. Learn more about stacking. |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Sorry @Connorbelez, you have reached your weekly rate limit of 500000 diff characters.
Please try again later or upgrade to continue using Sourcery
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
Your free trial has ended. If you'd like to continue receiving code reviews, you can add a payment method here.
Reviewer's GuideCentralizes RBAC permissions into a canonical catalog, updates auth helpers and middleware to respect an admin superuser grant, tightens onboarding and payments authorization, and wires UI/tests to consume the new catalog while keeping permission metadata and role matrices in sync. Sequence diagram for permission check with superuser overridesequenceDiagram
actor User
participant ClientFunction
participant ConvexMiddleware as requirePermission
participant PermissionCatalog as hasPermissionGrant
participant Handler
User->>ClientFunction: Invoke protected API
ClientFunction->>ConvexMiddleware: Call with viewer + requiredPermission
ConvexMiddleware->>PermissionCatalog: hasPermissionGrant(viewer.permissions, requiredPermission)
alt viewer has SUPERUSER_PERMISSION
PermissionCatalog-->>ConvexMiddleware: true (superuser)
else viewer has requiredPermission directly
PermissionCatalog-->>ConvexMiddleware: true
else no matching grant
PermissionCatalog-->>ConvexMiddleware: false
ConvexMiddleware->>ConvexMiddleware: auditAuthFailure
ConvexMiddleware-->>ClientFunction: throw permission error
ClientFunction-->>User: Show authorization error
end
ConvexMiddleware-->>Handler: next() when true
Handler-->>ClientFunction: business result
ClientFunction-->>User: Render success response
Updated class diagram for RBAC permission catalogclassDiagram
class PermissionDisplayMeta {
+string name
+string description
+string domain
}
class PermissionCatalogEntry {
+string name
+string description
+string domain
+boolean workos
+boolean grantsAllPermissions
}
class PermissionCatalogModule {
<<module>>
+SUPERUSER_PERMISSION : string
+PERMISSION_DISPLAY_METADATA : Record~PermissionSlug, PermissionDisplayMeta~
+ROLE_PERMISSIONS : Record~RoleSlug, PermissionSlug[]~
+ALL_PERMISSION_SLUGS : PermissionSlug[]
+PERMISSION_CATALOG : Record~PermissionSlug, PermissionCatalogEntry~
+WORKOS_PERMISSION_SLUGS : PermissionSlug[]
+hasPermissionGrant(permissions, permission) boolean
+hasAnyPermissionGrant(permissions, requiredPermissions) boolean
+lookupPermissions(roles) string[]
}
class RolePermissionsConsumer {
<<interface>>
+roles : string[]
+permissions : string[]
}
class Viewer {
+string? id
+Set~string~ roles
+Set~string~ permissions
}
class AuthLib {
<<module>>
+ISLAND_PERMISSIONS : object
+hasPermission(permissions, permission) boolean
+hasAnyPermission(permissions, requiredPermissions) boolean
+isFairLendStaffAdmin(context) boolean
}
class FluentMiddleware {
<<module>>
+requirePermission(permission) middleware
+requirePermissionAction(permission) middleware
}
class ResourceChecks {
<<module>>
+canAccessDocument(ctx, viewer, doc) Promise~boolean~
+canAccessApplicationPackage(ctx, viewer, pkg) Promise~boolean~
}
class UIDisplayMetadata {
<<module>>
+PERMISSION_DISPLAY_METADATA : Record~string, PermissionDisplayMeta~
+PERMISSION_DOMAINS : Record~string, string[]~
+DOMAIN_LABELS : Record~string, string~
+DOMAIN_COLORS : Record~string, object~
+ROLE_DISPLAY_METADATA : Record~string, object~
}
class UseCanDoHook {
<<hook>>
+useCanDo(permission) boolean
}
PermissionCatalogModule "1" o-- "*" PermissionCatalogEntry : builds
PermissionCatalogModule "1" o-- "*" PermissionDisplayMeta : uses
AuthLib ..> PermissionCatalogModule : imports hasPermissionGrant
FluentMiddleware ..> PermissionCatalogModule : imports hasPermissionGrant
ResourceChecks ..> PermissionCatalogModule : imports hasPermissionGrant
UIDisplayMetadata ..> PermissionCatalogModule : imports PERMISSION_DISPLAY_METADATA
UseCanDoHook ..> AuthLib : calls hasPermission
Viewer ..|> RolePermissionsConsumer
AuthLib ..> Viewer : reads permissions
FluentMiddleware ..> Viewer : checks permissions
Flow diagram for canonical RBAC catalog consumersflowchart LR
catalog["permissionCatalog.ts\n(PERMISSION_CATALOG, ROLE_PERMISSIONS, helpers)"]
fluent["convex/fluent.ts\n(requirePermission, requirePermissionAction)"]
authLib["src/lib/auth.ts\n(hasPermission, hasAnyPermission)"]
resourceChecks["convex/auth/resourceChecks.ts\n(canAccessDocument, canAccessApplicationPackage)"]
engine["convex/engine/commands.ts\n(transitionMortgage, confirmObligationPayment)"]
onboarding["convex/onboarding/*\n(requestRole, queries)"]
uiDemo["demo RBAC pages\n(access-control, audit, onboarding)"]
useCanDo["src/hooks/use-can-do.ts\n(useCanDo)"]
tests["auth tests\n(role-chains, catalog-sync, metadata-sync)"]
metadata["src/lib/rbac-display-metadata.ts\n(PERMISSION_DISPLAY_METADATA, domains)"]
catalog --> fluent
catalog --> authLib
catalog --> resourceChecks
catalog --> engine
catalog --> onboarding
authLib --> uiDemo
authLib --> useCanDo
catalog --> metadata
catalog --> tests
metadata --> uiDemo
fluent --> tests
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
Contributor
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 40 minutes and 30 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (25)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
Introduces a canonical RBAC permission catalog and refactors backend authorization, frontend permission helpers, and tests to derive from it, with tighter gating around onboarding and payments.
Changes:
- Add
convex/auth/permissionCatalog.tsas the single source of truth for permission slugs, display metadata, role mappings, and grant helper functions (incl.admin:accesssuperuser behavior). - Refactor backend permission enforcement (Convex fluent chains + onboarding + engine commands) and frontend permission checks to use catalog-backed helpers.
- Add/expand drift + integration tests to catch permission literal drift and validate new onboarding/payment auth chains.
Reviewed changes
Copilot reviewed 23 out of 25 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| src/test/auth/permissions/permission-metadata-sync.test.ts | Removes known-orphan allowance to enforce full metadata↔role alignment. |
| src/test/auth/permissions/catalog-sync.test.ts | Adds drift test scanning runtime for permission literals and comparing to catalog. |
| src/test/auth/permissions.ts | Switches test role-permission fixtures to import from canonical catalog. |
| src/test/auth/middleware/requirePermission.test.ts | Updates middleware tests for admin:access wildcard behavior. |
| src/test/auth/integration/onboarding-auth.test.ts | Adds onboarding onboarding:access enforcement coverage for queries/mutations. |
| src/test/auth/chains/role-chains.test.ts | Adds chain tests for payment mutations/webhooks and onboarding manage query. |
| src/routes/demo/rbac-auth/onboarding.tsx | Uses shared permission helper + staff-admin gate for review UI. |
| src/routes/demo/rbac-auth/audit.tsx | Uses shared permission helper + staff-admin gate for audit UI. |
| src/routes/demo/rbac-auth/access-control.tsx | Uses shared hasPermission helper rather than local Set logic. |
| src/lib/rbac-display-metadata.ts | Derives permission display metadata from canonical catalog; updates domain labels/colors. |
| src/lib/auth.ts | Replaces local wildcard logic with canonical grant helpers. |
| src/hooks/use-can-do.ts | Uses shared hasPermission helper for client-side permission checks. |
| src/components/demo/amps/dialogs.tsx | Refactors rule editor submit button icon logic for clearer busy/create/update states. |
| package.json | Adjusts @fast-check/vitest dev dependency version. |
| docs/superpowers/plans/2026-04-11-rbac-permission-reconciliation.md | Adds detailed implementation/rollout plan and drift matrix documentation. |
| convex/test/authTestEndpoints.ts | Adds new test endpoints for payment and onboarding permission chains. |
| convex/payments/transfers/types.ts | Extends transfer status typing for legacy "completed" handling. |
| convex/onboarding/queries.ts | Tightens onboarding admin queries to require onboarding:manage; adds onboarding:access to self-service query. |
| convex/onboarding/mutations.ts | Requires onboarding:access for role requests. |
| convex/fluent.ts | Centralizes permission grant checks and tightens payment/cash-ledger chains to admin-scoped chains. |
| convex/engine/commands.ts | Reconciles command permissions (mortgage transition + obligation payment confirm). |
| convex/auth/resourceChecks.ts | Uses catalog grant helper and updates sensitive document permission check. |
| convex/auth/permissionCatalog.ts | Adds canonical permission catalog, role mappings, and grant helper utilities. |
| convex/_generated/api.d.ts | Updates generated API types to include new permission catalog module. |
| bun.lock | Locks dependency version change for @fast-check/vitest. |
Comments suppressed due to low confidence (1)
convex/payments/transfers/types.ts:145
PersistedTransferStatusis declared twice in this file (same alias name, same definition). TypeScript will fail with a duplicate identifier error; remove one of the declarations and keep a single documented type alias.
export type TransferStatus = (typeof TRANSFER_STATUSES)[number];
export type PersistedTransferStatus = TransferStatus | "completed";
/**
* Persisted transfer status at the query boundary.
*
* Includes the legacy `"completed"` value while historical rows are still
* tolerated by webhook and reversal handlers.
*/
export type PersistedTransferStatus = TransferStatus | "completed";
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Owner
Author
Merge activity
|
Connorbelez
force-pushed
the
rbac-permission-reconciliation
branch
from
7730213 to
ef91a10
Compare
Connorbelez
force-pushed
the
graphite-base/394
branch
from
b8e26d6 to
7667859
Compare
Connorbelez
force-pushed
the
graphite-base/394
branch
from
7667859 to
4ea5880
Compare
Connorbelez
force-pushed
the
rbac-permission-reconciliation
branch
from
ef91a10 to
11eb30c
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by Sourcery
Introduce a canonical RBAC permission catalog and align role/permission metadata, runtime authorization, and tests with it, tightening onboarding and payments access control.
New Features:
Bug Fixes:
Enhancements:
Documentation:
Tests: