fix(authz): reserve role inheritance namespace

2026-08-23 19:35:03 +05:30
parent 4be4b2c346
commit 56cde5aaf8
4 changed files with 13 additions and 2 deletions
@@ -26,6 +26,12 @@ describe("defineAuthz", () => {
    expect(() => defineAuthz({ permissions: { "post:*": {} } })).toThrow(/wildcard/i);
  });

+  test("rejects permission ids that collide with role inheritance", () => {
+    expect(() => defineAuthz({ permissions: { "role:assign": {} } })).toThrow(
+      /reserved 'role:' prefix/i,
+    );
+  });
+
  test("rejects a role granting an unknown-shaped entry", () => {
    expect(() => defineAuthz({ roles: { editor: [""] } })).toThrow(/role 'editor'/i);
  });