Changelog

All notable changes to this package will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[1.3.0] - 2026-11-02

listScope(db, req, scope, activity, view, column): the filter a list applies, over the orgs under the requested ones (every org when none is named), each kept only where the caller holds the permission once the hooks have run.

The org, user, role, role hierarchy, rule, user rule, cross-org rule and delegation lists answered for the whole subtree of each permitted org, and a request naming the system org skipped the org filter entirely. Every org they answer for is now decided by the permission system with the hooks applied, so an org the hooks refuse never shows in a list, pinned or not, and the system org is an org like any other.

permittedScope(db, req, reply, orgIds, activity, view): the orgs of a list request the caller may act in, through the hooks; 403 only when none passes.

The list routes for users, roles, role settings, role, user and cross-org rules, delegations, permission profiles, user roles and activities checked only the first org of X-Org-Ids, then answered for every listed org. A caller allowed in the first org read the others' rows, and a caller refused in the first org got 403 for the whole list. They now answer for the permitted orgs only.
The unpinned org list, the stored org filter and readableOrgPaths decided with morbac.is_allowed in SQL, which skips the permission hooks. They now go through them, so an org the hooks refuse is never offered.

addPermissionHook('pre' | 'post', hook): application rules every permission decision runs. Hooks can only refuse; a throwing hook fails the decision.
isAllowed and permittedOrgs: the hooked decision without a reply, for one org or several.

hasPermission, hasPermissionAny, canPerform, canActOnUser, canGrantRule, the user listing and role assignment decide through isAllowed, so hooks apply to each.
The data proxy forwards only the X-Org-Ids the caller is allowed in, instead of every listed org once one passed. Rows are unchanged without hooks: RLS already hid the others.

First stable release of the Node.js companion to the pgmorbac PostgreSQL extension.
hasPermission and org-scope helpers backed by morbac.is_allowed.
withMorbacContext for running queries under the acting user so RLS applies.
PostgREST data proxy with per-route permissions and a hard page-size cap.
morbacMigrations() loader that ships the bundled extension SQL.
Fastify management routes for orgs, roles, rules, users, global rules, activities, and delegations.
PostgREST-style list-query parsing with allowlisted sort/filter columns.
JSON schema response fragments and shared domain types.
Unattributed org target: UNATTRIBUTED, OrgTarget and OrgSelection express a specific organisation, records with no org, or every org at once.
hasAnyPermission wraps the morbac.has_permission capability probe for UI gating.
withMorbacContext accepts an org selection, serialised to morbac.org_ids where a JSON null element names the unattributed bucket.