docs: add in-repo specs for SSO, permissions, and admin layers#13
Open
awais786 wants to merge 1 commit into
Open
docs: add in-repo specs for SSO, permissions, and admin layers#13awais786 wants to merge 1 commit into
awais786 wants to merge 1 commit into
Conversation
Replace reliance on external rule repos with repo-owned specs under docs/specs/. Each spec describes observed contract (not aspirational design) with file:line citations so reviewers can verify against code. - docs/specs/sso.md: OIDC/SAML providers, routes, strategies, dual gating (Enterprise licence + per-workspace BillingEntitlementKey.SSO) - docs/specs/permissions.md: SettingsPermissionGuard, PermissionFlagType split (settings vs tool flags), checkRolePermissions logic, and the object-permission cache that hides workflow data from non-permitted roles - docs/specs/admin-panel.md: two-layer admin model (canAccessFullAdminPanel vs workspace Admin role), AdminPanelGuard, JWT-baked admin flag and the sign-out requirement after DB flips - CLAUDE.md: summary sections (Access Control, SSO, Specs) pointing at the new specs Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
docs/specs/directory holding repo-owned capability specs (replacing reliance on external rule sets)CLAUDE.mdextended with three summary sections pointing at the new specsWhy
Past sessions kept re-exploring the same surface (workflow gating, admin layers, SSO providers) because the knowledge lived in an external repo. Folding it into
docs/specs/makes the contract reviewable in the same PR as the code that implements it, and travels with the repo.What's in each spec
docs/specs/sso.md—WorkspaceSSOIdentityProviderentity, the five/auth/oidc|saml/*routes, OIDC/SAML strategies, dual gating (EnterpriseFeaturesEnabledGuard+BillingEntitlementKey.SSO), login resolution, frontenduseSSOflow, gotchasdocs/specs/permissions.md—SettingsPermissionGuard, thePermissionFlagTypesplit into Settings flags (bypassed bycanUpdateAllSettings) and Tool flags (bypassed bycanAccessAllTools),checkRolePermissionslogic, the second enforcement layer inworkspace-roles-permissions-cache.service.tsthat hides workflow data when the flag is off, worked workflow exampledocs/specs/admin-panel.md—canAccessFullAdminPanelinstance flag vs workspace Admin role,AdminPanelGuard,/admin-panel-graphql-apiendpoint, JWT-baked admin flag and the sign-out-required gotcha, promotion pathsdocs/specs/README.md— index + conventions for keeping specs in sync with codeScope
This spec set describes upstream Twenty as it lives in this repo. Fork-only behaviour (proxy-login controller,
ProxyAuthMiddleware,AUTH_TYPE=SSOheader-trust path) is explicitly out of scope and is noted as such indocs/specs/sso.mdso future readers don't grep for code that isn't here.Test plan
file:linereferences resolve in the working treeCLAUDE.mdrenders cleanly (new sections: Access Control & Permissions, SSO, Specs)🤖 Generated with Claude Code