feat(admin): widen AdminPermission to accept plugin-declared actions - #5
Merged
Merged
Conversation
@dune/core@^0.34.4's DunePlugin.authzActions lets a plugin declare its own admin-permission action and gate a route behind it via withGuards()/requirePermission() the identical way as a built-in one. AdminPermission was a closed union listing only the built-ins, so a plugin author could only pass a custom action through with a `permission: "..." as never` type-level workaround — checkPermission()/ requirePermission()/withGuards() were already just forwarding whatever string they were given straight to authz.check(), so this is purely a type change, no runtime behavior change. guards.ts's own doc example now shows a plugin declaring authzActions and gating a mount()-registered route behind it (previously used an undeclared "settings.update" permission that would have failed deno check had the example itself ever been type-checked). New test proving a non-built-in permission string type-checks through withGuards() with no cast and forwards correctly to authz.check() in both directions (allow/deny). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
zumbrunn
force-pushed
the
feat/plugin-extensible-authz-schema
branch
from
September 2, 2026 08:58
b30621e to
6ee6b12
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Widens
AdminPermissionfrom a closed union of the built-in admin actions to also accept any string (AdminPermission | (string & {})pattern — keeps autocomplete for the built-ins, accepts anything else).Why
Companion to
@dune/core'sDunePlugin.authzActions(separate PR,@dune/core@^0.34.4), which lets a plugin declare its own admin-permission action (e.g."billing.manage") merged into the site's authz schema at bootstrap.checkPermission()/requirePermission()/withGuards()already just forward whatever permission string they're given straight toauthz.check()— the real authority either way — so the closed union here was the only thing stopping a plugin author from actually using this without apermission: "..." as neverworkaround. Pure type change, no runtime behavior change.Also fixed
guards.ts's own doc example, which referenced an undeclared"settings.update"permission that was never a real built-in — would have faileddeno checkhad the example itself ever been type-checked. Now shows a plugin declaringauthzActionsand gating a route behind it.Testing
withGuards()with no cast, forwards correctly toauthz.check()in both directions (allow/deny).deno test -A— 233 passed, 0 failed.deno lint src/anddeno checkclean.Requires
@dune/core@^0.34.4— see that repo's companion PR. Note@dune/core@0.34.4has not itself published to JSR yet as of this PR.🤖 Generated with Claude Code