5 Commits

Include renames

Author	SHA1	Message	Date
Clintchiz	226217ecbf	feat(authz): reach the merged catalog from boot via a process-wide singleton ... Fix round 1 for Task 14 — closes the gap flagged in the last report: loadAppAuthzCatalog existed but nothing called it. - packages/authz/src/client.ts (new): setAuthzCatalog/getAuthzCatalog/ hasAuthzCatalog, mirroring @wrnexus/db's client.ts. App middleware runs at module-eval time and needs the catalog then, so ctx cannot carry it; getAuthzCatalog() throws a setup error naming the fix, like getDb() does. Exported from packages/authz/src/index.ts. - packages/dev-server/src/index.ts: startServer calls loadAppAuthzCatalog + setAuthzCatalog before middleware is resolved (schemasJs precedent), and populates the new RuntimeDeps.authz field. - packages/dev-server/src/runtime.ts: RuntimeDeps gains authz?: AuthzCatalog. - packages/cli/src/build.ts: emits static imports of each app/authz/*.ts file into the generated entry (components/layouts precedent) and passes { source, module } pairs through ProdOptions.authz — the catalog holds policy functions, so it cannot be JSON-baked like schemasJs. - packages/dev-server/src/prod.ts: createProductionHandlers merges those declarations and calls setAuthzCatalog before the server accepts traffic, so a conflict fails the boot instead of surfacing on the first request. Runs for every deployment adapter, not only Bun.serve. The framework never installs authzMiddleware itself; the app still registers it with its own store. Verified end-to-end: added a temporary app/authz declaration to examples/basic-app, ran `bun run build`, inspected the generated entry's static import + authz array, and booted dist/server.js to confirm the merge/setAuthzCatalog call succeeds against real bundled code (reverted before commit).	2026-08-04 22:40:42 +05:30
Clintchiz	726b8a7d24	feat(authz): generate Permission and Role union types ... Emits sorted TS unions from the merged catalog so a typo in can(ctx, "post:wrtie") is a compile-time error. Uses JSON.stringify for string-literal escaping (not manual backslash/quote replace) so role names containing raw newlines still produce valid TypeScript; role names are not regex-validated like permission ids, so this matters for the raw mergeCatalogs path.	2026-08-04 21:19:04 +05:30
Clintchiz	3fa3fce5df	feat(authz): add database-backed PermissionStore ... Adds dbPermissionStore/ensureAuthzTables/authzMigrationSql, backed by _wrn_authz_assignment and _wrn_authz_grant tables, plus a ./db subpath export. Passes the identical 19-test store-conformance suite the memory adapter passes, including tenant-scope isolation.	2026-08-04 20:22:31 +05:30
Clintchiz	6f3a53b9ff	feat(authz): export registry, store, engine, and middleware surface ... Appends the Task 1-8 modules (defineAuthz, catalog merge helpers, permission stores, audit sinks, resolver engine, and authzMiddleware/ can/guards) to the public @wrnexus/authz surface, and regenerates the public-api-0.8.json baseline to match.	2026-08-04 19:29:08 +05:30
Clintchiz	586a6db8ff	release: WRNexusJS 0.8.0	2026-08-02 23:18:51 +05:30