# Changelog

All notable changes to this package will be documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [1.3.0] - 2026-11-02

### Added
- `listScope(db, req, scope, activity, view, column)`: the filter a list applies, over the orgs under the requested ones (every org when none is named), each kept only where the caller holds the permission once the hooks have run.

### Fixed
- The org, user, role, role hierarchy, rule, user rule, cross-org rule and delegation lists answered for the whole subtree of each permitted org, and a request naming the system org skipped the org filter entirely. Every org they answer for is now decided by the permission system with the hooks applied, so an org the hooks refuse never shows in a list, pinned or not, and the system org is an org like any other.

## [1.2.0] - 2026-11-02

### Added
- `permittedScope(db, req, reply, orgIds, activity, view)`: the orgs of a list request the caller may act in, through the hooks; 403 only when none passes.

### Fixed
- The list routes for users, roles, role settings, role, user and cross-org rules, delegations, permission profiles, user roles and activities checked only the first org of `X-Org-Ids`, then answered for every listed org. A caller allowed in the first org read the others' rows, and a caller refused in the first org got 403 for the whole list. They now answer for the permitted orgs only.
- The unpinned org list, the stored org filter and `readableOrgPaths` decided with `morbac.is_allowed` in SQL, which skips the permission hooks. They now go through them, so an org the hooks refuse is never offered.

## [1.1.0] - 2026-10-21

### Added
- `addPermissionHook('pre' | 'post', hook)`: application rules every permission decision runs. Hooks can only refuse; a throwing hook fails the decision.
- `isAllowed` and `permittedOrgs`: the hooked decision without a reply, for one org or several.

### Changed
- `hasPermission`, `hasPermissionAny`, `canPerform`, `canActOnUser`, `canGrantRule`, the user listing and role assignment decide through `isAllowed`, so hooks apply to each.
- The data proxy forwards only the `X-Org-Ids` the caller is allowed in, instead of every listed org once one passed. Rows are unchanged without hooks: RLS already hid the others.

## [1.0.0] - 2026-07-25

### Added
- First stable release of the Node.js companion to the `pgmorbac` PostgreSQL extension.
- `hasPermission` and org-scope helpers backed by `morbac.is_allowed`.
- `withMorbacContext` for running queries under the acting user so RLS applies.
- PostgREST data proxy with per-route permissions and a hard page-size cap.
- `morbacMigrations()` loader that ships the bundled extension SQL.
- Fastify management routes for orgs, roles, rules, users, global rules, activities, and delegations.
- PostgREST-style list-query parsing with allowlisted sort/filter columns.
- JSON schema response fragments and shared domain types.
- Unattributed org target: `UNATTRIBUTED`, `OrgTarget` and `OrgSelection` express
  a specific organisation, records with no org, or every org at once.
- `hasAnyPermission` wraps the `morbac.has_permission` capability probe for UI gating.
- `withMorbacContext` accepts an org selection, serialised to `morbac.org_ids`
  where a JSON null element names the unattributed bucket.

[1.0.0]: https://github.com/crudylabs/pgmorbac-fastify/releases/tag/v1.0.0