docs: fix CGS permission matrix and owner-role claims (HYPER-332)#140
Conversation
Cross-checked the CGS hub page against the service source: - Permission matrix conflated "edit any record" into the member row; members can only edit/delete records they authored. Editing any member's record requires admin. - Owner role described as promotable via role.set; it is immutable, fixed at registration. Removed the "last-owner protection" claim in favour of full owner immutability (role.set and member.remove both reject the owner role). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
|
@aspiers is attempting to deploy a commit to the Hypercerts Foundation Team on Vercel. A member of the Team first needs to authorize it. |
|
Warning Review limit reached
More reviews will be available in 29 minutes and 34 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
There was a problem hiding this comment.
Pull request overview
Updates the Certified Group Service (CGS) architecture documentation to match the service’s current RBAC behavior, correcting previously inaccurate permissions/role semantics.
Changes:
- Refines the RBAC permission matrix to distinguish “own record” vs “any record” edit/delete capabilities.
- Corrects the description of the
ownerrole to reflect that it is immutable (not assignable/demotable viarole.set/member.remove).
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
…-332) A deeper pass against the CGS source surfaced gaps the first review missed: - The service-level endpoint app.certified.groups.membership.list (list every group the caller belongs to) was undocumented. Added a "Cross-group membership" section. - The Authentication "Audience" check claimed aud is always a group DID; cross-group endpoints instead require aud = the service's own DID. Clarified both paths. - The Storage section omitted the global member_index table that backs the cross-group query. Added it. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Address CodeRabbit review on PR hypercerts-org#140: use "on this group service" (the lexicon's own description wording) instead of "on this CGS instance" for the cross-group membership endpoint. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Address Copilot review on PR hypercerts-org#140: the "self-removal always succeeds, regardless of role" bullet contradicted the new owner-immutability rule. Per src/api/member/remove.ts, the owner check throws CannotRemoveOwner before any self-removal allowance, so an owner cannot remove themselves. Reworded both bullets to make the owner exception explicit. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Summary
Cross-checked the Certified Group Service page (
pages/architecture/certified-group-service.md) against the service source code and corrected two inaccuracies in the RBAC section. Companion to hypercerts-org/certified-group-service#25 (the in-repo doc fixes, now merged).putOwnRecord/deleteOwnRecord); editing or deleting any member's record requires admin (putAnyRecord/deleteAnyRecord). Split into separate own/any rows.role.set, with a "last-owner protection" claim. The owner role is in fact immutable — fixed at registration, androle.set/member.removeboth reject it (CannotPromoteToOwner/CannotModifyOwner/CannotRemoveOwner). Ownership transfer is a separate, not-yet-implemented operation.The other CGS-mentioning hub pages (overview, account-and-identity, certified-pdss, epds, glossary) were audited and are accurate — no changes needed. No "GPDS" / "group PDS" terminology violations anywhere.
Test plan
certified-group-service/src(rbac/permissions.ts,api/role/set.ts,api/member/remove.ts)/architecture/certified-group-service🤖 Generated with Claude Code