fix(authz): reserve role inheritance namespace

2026-08-23 19:35:03 +05:30
parent 4be4b2c346
commit 56cde5aaf8
4 changed files with 13 additions and 2 deletions
@@ -16,6 +16,11 @@ export function defineAuthz<Subject = any, Resource = any>(
  const bindings = module.bindings ?? {};

  for (const id of Object.keys(permissions)) {
+    if (id.startsWith("role:")) {
+      throw new Error(
+        `WRN-AUTHZ-DECL: permission id '${id}' uses the reserved 'role:' prefix; role grants use 'role:<name>' for inheritance.`,
+      );
+    }
    if (id.includes("*")) {
      throw new Error(
        `WRN-AUTHZ-DECL: permission id '${id}' must not contain a wildcard; wildcards belong in roles.`,