feat(permissions): custom roles with scopes, API guards, and post review workflows - #630

Open

mezotv wants to merge 12 commits into

mainfrom

emdash/ready-chairs-prove-0oicf

Commits on Jul 29, 2026

feat(permissions): custom roles with scopes, API guards, and post review workflows
mezotv
committed
ac546ec
fix(permissions): address react-doctor findings
mezotv
committed
4d966d1
fix(reviews): lock approval requests during review and gate withdrawal
mezotv
committed
d877874

Commits on Jul 30, 2026

fix(reviews): let reviewers withdraw posts and sync API status changes
mezotv
committed
aa4af34
fix(api): cancel pending approval requests atomically with status change
mezotv
committed
c2165e3
fix(roles): prevent privilege escalation via role assignment and handle duplicate chat slugs
mezotv
committed
89c4803
fix(content): cancel pending reviews atomically with dashboard status updates
mezotv
committed
1a26e10
fix(roles): block scope escalation through role create and update
mezotv
committed
314324d
fix(content): guard status transitions against concurrent changes
mezotv
committed
75df4d7
refactor(access-groups): rename custom roles to access groups
mezotv
committed
53e2917
fix(permissions): restrict legacy scope fallback to pre-adoption workspaces
mezotv
committed
596bb52
fix(api): guard REST status transitions against concurrent changes
mezotv
committed
e5c8d4f