fix(authz): reserve role inheritance namespace

bun.lock

@@ -257,7 +257,7 @@
     },
     "packages/authz": {
       "name": "@wrnexus/authz",
-      "version": "0.8.14",
+      "version": "0.8.15",
       "dependencies": {
         "@wrnexus/core": "workspace:*",
         "@wrnexus/db": "workspace:*",

packages/authz/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/authz",
-  "version": "0.8.14",
+  "version": "0.8.15",
   "private": true,
   "type": "module",
   "main": "src/index.ts",

packages/authz/src/registry.ts

@@ -16,6 +16,11 @@ export function defineAuthz<Subject = any, Resource = any>(
   const bindings = module.bindings ?? {};
 
   for (const id of Object.keys(permissions)) {
+    if (id.startsWith("role:")) {
+      throw new Error(
+        `WRN-AUTHZ-DECL: permission id '${id}' uses the reserved 'role:' prefix; role grants use 'role:<name>' for inheritance.`,
+      );
+    }
     if (id.includes("*")) {
       throw new Error(
         `WRN-AUTHZ-DECL: permission id '${id}' must not contain a wildcard; wildcards belong in roles.`,

packages/authz/test/registry.test.ts

@@ -26,6 +26,12 @@ describe("defineAuthz", () => {
     expect(() => defineAuthz({ permissions: { "post:*": {} } })).toThrow(/wildcard/i);
   });
 
+  test("rejects permission ids that collide with role inheritance", () => {
+    expect(() => defineAuthz({ permissions: { "role:assign": {} } })).toThrow(
+      /reserved 'role:' prefix/i,
+    );
+  });
+
   test("rejects a role granting an unknown-shaped entry", () => {
     expect(() => defineAuthz({ roles: { editor: [""] } })).toThrow(/role 'editor'/i);
   });