feat(teams): per-member permission overrides - #19

Merged

kipavy merged 19 commits into

mainfrom

feat/per-member-permission-overrides

Sep 12, 2026

Commits on Sep 10, 2026

feat(perms): add per-member permission override table
kipavy
committed
bf5d700
refactor(perms): share one effective-permission query between both resolvers
kipavy
committed
60f35d1
feat(perms): apply per-member allow/deny overlay in the team resolver
kipavy
committed
efa9c1a
fix(perms): resolve multi-team permission checks per team, not across the union
kipavy
committed
d9d9069
feat(teams): serve per-member permission masks on the team and member endpoints
kipavy
committed
264ac3a
feat(teams): add endpoint to set a member's permission overrides
kipavy
committed
c59f5ab
feat(teams): guard permission-override writes by ownership, self, grant scope and role position
kipavy
committed
f2d001a
test(teams): pin the self-edit guardrail with a role-holding actor
kipavy
committed
4e8e4d9
test(teams): pin owner immunity independently and cover the roleless-target path
kipavy
committed
b61ce3c
test(teams): catch a swapped actor/target at the permissions handler call site
kipavy
committed
ad217ef
feat(teams): queue a key rotation when a read-class permission is denied
kipavy
committed
a047a20
fix(teams): make the permission write and its rotation request atomic
kipavy
committed
bda6356

Commits on Sep 11, 2026