Files

T

james 2136a48fbe chore(openspec): archive the mock-migration waves and green the spec set

Archive the three completed changes behind replace-mock-api-wave-1/2/3. Each
merge applied cleanly to the main specs:

- catalog gains the Public product browse requirement (subtree filtering and
  price sort)
- frontend-mall picks up the per-domain adapter, the pinned home page, the
  discovery-page changes, the live auth panels and the live transaction flows
- cart's Server-side cart requirement now documents the shop and stock carried
  by every line

Also replace the TBD Purpose placeholder in all eleven specs with a one-line
description of what each capability covers. Those placeholders predate this
work and were the only reason `openspec validate --all --strict` reported
0 passed / 11 failed; it now reports 11 passed / 0 failed.

2026-09-17 16:36:10 +00:00

890 B

Raw Permalink Blame History

rbac Specification

Purpose

The role model and the enforcement of role- and shop-scoped access.

Requirements

Requirement: Role model

The system SHALL support roles platform_admin, shop_owner, shop_staff, customer. Shop roles MUST carry a shop_id scope.

Scenario: seeded platform admin

WHEN migrations run on a fresh database
THEN a platform_admin account exists and can log in

Requirement: Role enforcement

Protected routes SHALL declare required roles; the API MUST reject requests with insufficient role using 403.

Scenario: customer hits admin route

WHEN a customer token calls an /api/admin/* route
THEN the API returns 403 with code FORBIDDEN

Scenario: shop scope isolation

WHEN a shop_owner of shop A accesses /api/shop/* resources of shop B
THEN the API returns 403 or 404, never the data

890 B Raw Permalink Blame History