kibin/NetForge
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(01-04): complete CASL RBAC plan

Browse Source 
Tasks completed: 2/2
- Task 1: CASL permission definitions and ability factory
- Task 2: API authorization middleware and RBAC tests

SUMMARY: .planning/phases/01-foundation/01-04-SUMMARY.md
This commit is contained in:
kevin-asprec
2026-03-04 18:59:14 +08:00
parent 1df2b2d87d
commit d25885aaeb
2 changed files with 182 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
.planning/STATE.md
View File

@@ -10,28 +10,28 @@ See: .planning/PROJECT.md (updated 2026-03-04)
## Current Position
Phase: 1 of 5 (Foundation)
Plan: 3 of 5 in current phase
Plan: 4 of 5 in current phase
Status: In progress
Last activity: 2026-03-04 — Completed 01-03-PLAN.md (tenant provisioning, Prisma middleware, RLS, isolation tests)
Last activity: 2026-03-04 — Completed 01-04-PLAN.md (CASL RBAC, 5-role permission matrix, API middleware, 66 tests)
Progress: [███░░░░░░░] 15% (3/20 plans across all phases)
Progress: [████░░░░░░] 20% (4/20 plans across all phases)
## Performance Metrics
**Velocity:**
- Total plans completed: 3
- Average duration: 9.3 min
- Total execution time: 28 min
- Total plans completed: 4
- Average duration: 8.75 min
- Total execution time: 35 min
**By Phase:**
| Phase | Plans | Total | Avg/Plan |
|-------|-------|-------|----------|
| 01-foundation | 3/5 complete | 28 min | 9.3 min |
| 01-foundation | 4/5 complete | 35 min | 8.75 min |
**Recent Trend:**
- Last 5 plans: 01-01 (11 min), 01-02 (8 min), 01-03 (9 min)
- Trend: stable at ~9 min/plan
- Last 5 plans: 01-01 (11 min), 01-02 (8 min), 01-03 (9 min), 01-04 (7 min)
- Trend: stable at ~8-9 min/plan
*Updated after each plan completion*
@@ -59,6 +59,11 @@ Recent decisions affecting current work:
- [01-03]: findUnique cross-tenant protection routes through findFirst internally — Prisma unique key cannot have tenantId injected without changing where shape
- [01-03]: RLS USING allows null app.current_tenant_id — super-admin mode (no tenant context) sees all rows
- [01-03]: Initial migration baselined with migrate resolve --applied (schema was created via db push in 01-01)
- [01-04]: createMongoAbility used throughout (not PureAbility) — string subjects require conditionsMatcher which createMongoAbility provides built-in
- [01-04]: cannot() rules excluded when merging multi-role abilities — additive union means more roles = more (never less) access
- [01-04]: Condition objects cast via any for string subjects — CASL infers MongoQuery<never> for strings; tighten when Prisma models defined in Phase 2+
- [01-04]: Technician can("read", "Subscriber") coarse-grained — data layer enforces actual scope to assigned job contacts only
- [01-04]: withPermission() HOF wraps Next.js route handlers; authorize() as convenience alias
### Pending Todos
@@ -68,10 +73,10 @@ None.
- [Phase 1 research flag]: MikroTik RouterOS Node.js client library maintenance status is LOW confidence — verify `node-routeros` vs `mikronode` before implementing router integration (MikroTik integration is v2, but adapter interface should be planned)
- [Phase 3 research flag]: Semaphore SMS API pricing/stability for 2026 is MEDIUM confidence — verify before any SMS work (SMS is v2, but abstraction layer design is relevant)
- [01-03 resolved]: prisma-tenant.ts TypeScript errors fixed — Prisma $extends create/upsert required destructuring tenant relation before spreading tenantId
- [01-04 note]: CASL condition types for string subjects use any cast — upgrade to class-based subjects when Phase 2 Prisma models (Subscriber, Invoice, etc.) are defined
## Session Continuity
Last session: 2026-03-04T10:45:22Z
Stopped at: Completed 01-03-PLAN.md (tenant provisioning + Prisma middleware + RLS + isolation tests)
Last session: 2026-03-04T10:57:37Z
Stopped at: Completed 01-04-PLAN.md (CASL RBAC + 5-role permission matrix + API middleware + 66 tests)
Resume file: None