feat(authorization): add allOf/anyOf combinators to role grants

feat(authorization): add allOf/anyOf combinators to role grantsburgan-tech/vnext #1071 · 6 diagrams

◈ Rendered by PR Lens · crafted with ❤️ by the Coldtea team

100%

01 / 06Role grants now support allOf and anyOfA grant can combine roles with logical AND or OR at depth 1 instead of allowing only single roles.The defines combinator conditions, validated at publish by component rules in +45 −7.
02 / 06Matcher now evaluates three-valued logicUnknown role-bound leaves refuse deny grants, while allow grants require a proven Yes.The evaluates Kleene logic across caller roles and identity in +92 −0.
03 / 06SubFlow queryRoles now decided at leaf onlyVisibility in active SubFlow chains is checked at the deepest child without ANDing parent levels.The forwards to the active child and evaluates queryRoles at the leaf in +16 −19.
04 / 06Human task hop now carries caller identityLeaf tasks receive actor and subject usernames so predefined starter roles evaluate in remote scopes.The passes caller identity to the evaluator in +7 −3.
05 / 06Publish validators now reject invalid grantsMalformed combinator shapes and dynamic role paths in schemas and functions now return 400 at publish.The check x-roles and reject combinators in exemption lists in +40 −0.
06 / 06Everything this change touchedThe authorization matcher, role models, leaf queries, validators, and metadata across 63 files.

esc to leave