v0.2.0.8 — RBAC & API fixes

v0.2.0.8 — RBAC & API fixes

Fixed

• RBAC view-permissions. Routes for GET /projects, /tasks, /clients, /worklogs now accept view-level permissions (project.view, task.view, client.view, worklog.view) in addition to manage permissions. Standard users can now list and view entities they have access to via team membership.

• Permission evaluation logic. Route permission arrays now use OR logic: a user needs AT LEAST ONE of the listed permissions, not ALL of them. This fixes the impossible view+manage permission pair scenario.

• Team member IDs. POST /teams with member_user_ids now accepts public_id strings (e.g. "usr_XXX") in addition to integer IDs. Previously public_id strings were silently converted to 0.

• Task creation. POST /tasks now accepts both project_public_id and project_id fields, and assignee_user_id resolves public_id strings to integer IDs.

• Default role assignment. Creating a user without role_public_ids now automatically assigns the first non-system role that has permissions.

• Installer database.php. The installer now writes database.php configuration during installation.

Testing

• Full functional audit on fresh install (install-test.tropatt.com)
• 6 internal users with role-based access verified
• External user invite/accept/login flow verified
• RLS scoping: external users see only assigned projects/tasks