Changelog

v2.0.0

Major changes

• Admin API and screens for day-to-day use (same in the Go module):

  • Validation problems carry field, the request field they are about.
  • GET /assignments searches (q) and pages by cursor (limit, cursor, nextCursor).
  • POST /assignments/preview runs the assignment rules without writing and returns what the assignment would grant and require.
  • Roles include usage (active assignments and group mappings).
  • GET /changes filters by kind (a kind or a family), actor, target and severity.
  • The React admin screens use @zynactra/ui 0.3: role editor in a sheet with permission search and select-all, typed confirmation to delete, toasts with undo, field-level errors, a preview-driven assignment form with a date-time picker for the end, server search and Load more, people shown by name, org units picked from a tree, and a filterable change log with a diff per change. AccessAdmin takes searchUsers; PickOption gains description and parentId.

  Migration from 1.x:

  • GET /assignments returns at most 100 items per page (limit up to 500). Follow nextCursor to read everything. client.listAssignments() (React) and AdminService.listAssignments() now return { items, nextCursor? } instead of an array.
  • AdminService.listChanges(actor, limit, beforeId) is now listChanges(actor, { limit, beforeId, kind, actorId, targetId, severity }).
  • Custom AdminStore implementations: listAssignments returns an AssignmentPage and honours query, limit and cursor (use encodeCursor/decodeCursor); listChanges(orgId, filter) takes a ChangeFilter; roles carry usage. @zynactra/access-drizzle does all of this.
  • @zynactra/access-react/admin: OptionPicker and MultiOptionPicker are replaced by UserPicker and ScopeIdsPicker, and RoleDialog by RoleEditor (same props). The peer dependency is @zynactra/ui ^0.3.0, and the screens confirm changes with toasts, so mount <Toaster> from @zynactra/ui/toast once.

Minor changes

• Use more of Cerbos (same in the Go module):

  • Org rules. zaccess.yaml takes orgRules: [./orgs/*.yaml]: per-org rules that deny product permissions when a condition holds, compiled into Cerbos scoped policies that can only narrow. The SDKs send the org as the Cerbos scope for kinds it has rules for. Checks, list plans and Explain all apply them.
  • Explain says why. Generated rules emit outputs, so Explain reports the scope that allowed a decision (scope) and finer deny reasons: other_org, scope, condition, org_rule (with orgRule). The admin screen shows them. Clients that only know policy can keep treating unknown reasons as policy.
  • Smaller Cerbos requests. Checks and plans send only the permissions they decide, not the subject's whole access.
  • Decision logs. The example cerbos.yaml turns on Cerbos decision logs (stdout); copy it.
  • Fix: a negated condition over a nullable column no longer drops rows where the column is NULL. Both SQL translators emit (...) IS NOT TRUE instead of NOT (...), matching the check.

  Regenerate with zaccess gen to get the outputs in your policies.

• Docs for everything, on the Zynactra docs site and in the package:

  • The docs now live in docs/content and are published with the other Zynactra libraries by zynactra/docs-central: concepts, a guide per stack, list filters, field-level permissions, admin screens, deploying, and reference pages for the manifest, the CLI, the HTTP API, both SDKs, errors and configuration. The design decisions moved there too.
  • @zynactra/access ships them as markdown in docs/ (node_modules/@zynactra/access/docs/README.md), and the Claude Code plugin's references are the same pages, so agents read exactly what the site says.
  • New @zynactra/access-react/testing: fakeAccessApi, an in-memory access API for tests, demos and docs (pass its fetch to createAccessClient), with adminSummary and globalGrant().
  • Fix: in the assign dialog, assigning a role to yourself is shown at the person field, not as "You can't grant this" at the role field.

v1.0.0

Minor changes

• First release of zynactra/access: manifests and zaccess codegen, scoped grants evaluated by Cerbos, plan-to-SQL list filters, the admin service and API with no-escalation rules, the Postgres store with NOTIFY cache invalidation, the NestJS module, React hooks and admin screens, and the Go SDK with the same behaviour (shared conformance fixtures).