james
2136a48fbe
Archive the three completed changes behind replace-mock-api-wave-1/2/3. Each merge applied cleanly to the main specs: - catalog gains the Public product browse requirement (subtree filtering and price sort) - frontend-mall picks up the per-domain adapter, the pinned home page, the discovery-page changes, the live auth panels and the live transaction flows - cart's Server-side cart requirement now documents the shop and stock carried by every line Also replace the TBD Purpose placeholder in all eleven specs with a one-line description of what each capability covers. Those placeholders predate this work and were the only reason `openspec validate --all --strict` reported 0 passed / 11 failed; it now reports 11 passed / 0 failed.
24 lines
890 B
Markdown
24 lines
890 B
Markdown
# rbac Specification
|
|
|
|
## Purpose
|
|
The role model and the enforcement of role- and shop-scoped access.
|
|
## Requirements
|
|
### Requirement: Role model
|
|
The system SHALL support roles `platform_admin`, `shop_owner`, `shop_staff`, `customer`. Shop roles MUST carry a `shop_id` scope.
|
|
|
|
#### Scenario: seeded platform admin
|
|
- **WHEN** migrations run on a fresh database
|
|
- **THEN** a `platform_admin` account exists and can log in
|
|
|
|
### Requirement: Role enforcement
|
|
Protected routes SHALL declare required roles; the API MUST reject requests with insufficient role using 403.
|
|
|
|
#### Scenario: customer hits admin route
|
|
- **WHEN** a `customer` token calls an `/api/admin/*` route
|
|
- **THEN** the API returns 403 with code `FORBIDDEN`
|
|
|
|
#### Scenario: shop scope isolation
|
|
- **WHEN** a `shop_owner` of shop A accesses `/api/shop/*` resources of shop B
|
|
- **THEN** the API returns 403 or 404, never the data
|
|
|