v0.14.4

0.14.4

Patch Changes

• chore: check the packed tarball can resolve its own imports

v0.14.3

0.14.3

Patch Changes

• chore(renovate): drop dead @kernhq automerge rule

v0.14.2

0.14.2

Patch Changes

• test: cover the workspace-removal path of the acl re-index

v0.14.1

0.14.1

Patch Changes

• 6ae3fb6: Re-index a project's issues when who may read it changes, and make the acl sweep come round again.

  The search acl is denormalised onto every issue document, and only a mutation on the issue itself
  rewrote it. So a project turned private, and a member removed from a private one, left the old
  readers holding the key, title and indexed description of every issue in that project until somebody
  happened to edit one — issues.get answered FORBIDDEN while workspace search still returned the
  title. projects.update (on a visibility change), addMembers, removeMember and the
  core.member.removed subscription now re-index the project. The same call fixes the other
  direction: a member added to a private project could not find its issues at all.

  The search-acl job stamped each workspace once and never revisited it, so it could only repair the
  acls that were wrong the day it first ran. It now takes the oldest stamps first — never swept
  before the rest — and re-stamps, sweeping a workspace at most once a day.

  Still open, and stated in services/search.ts: a project-scoped deny binding fails open. A deny
  is subtractive and an acl is a set overlap, so a caller denied one project keeps the hit while
  issues.get refuses them. Closing it needs core to match a hit against the module's visible set, or
  to apply denies alongside subjects.

v0.14.0

0.14.0

Minor Changes

• 3189476: Give indexed issues a real search acl, and unblock the three refusals a project-scoped caller met.

  Issues were indexed with acl: null, which core reads as "visible to everybody in this workspace",
  so workspace search served every member the key, title and indexed description of every issue in
  every project — including projects they were refused when they opened one. Documents now carry the
  readers of their project, and a search-acl job re-indexes workspaces whose documents predate this.

  Alongside it: views.list no longer fails with a raw Postgres error when the caller can see no
  project, projects.list answers an empty list instead of 403 for a caller without the
  workspace-scoped permission, and the URL in every tracker notification and search hit now opens the
  issue rather than the issue list.

  IssueService.reindex takes the caller's transaction as its first argument.

v0.13.1

0.13.1

Patch Changes

• bea0aec: Scope the demo seeder's emptiness guard to the workspace.

  The guard left workspace_id to row-level security. The transaction is bound to the workspace, so
  on a correctly-configured instance RLS scopes it — and on any database whose owner can bypass a
  policy it does not, so the guard saw the previous workspace's rows and reported an empty workspace
  as used. Measured on a development database: the first workspace filled, and every one after it was
  created empty while the log said "workspace not empty". The predicate is written out now, and each
  seeder's test seeds a second workspace in the same database, which is what reproduces it.

v0.13.0

0.13.0

Minor Changes

• bccf578: Fill a workspace created with example content: three projects, twenty-five issues across the board,
  labels, components, a version, a milestone and four cycles.

  Written through the module's own services rather than as inserts, so the issues have keys from the
  project counter, ranks, the template's workflow and the status history the cycle report reads. Two
  things it cost a run to learn, both recorded in the file: StatusCategory is
  backlog | todo | in_progress | done | cancelled | triage and an invented name moves nothing while
  reporting success, and the support project uses the simple template because the support one
  installs a workspace-level impact field marked required — which then refuses every issue in every
  other project in the workspace.

v0.12.4

0.12.4

Patch Changes

• build: force one @kernhq/kernel copy with pnpm.overrides

v0.12.3

0.12.3

Patch Changes

• build(deps): raise @kernhq/testing to ^0.1.14

v0.12.2

0.12.2

Patch Changes

• test: fail on a tenant table with no policy, not only an unforced one