Changelog

All notable changes to this package will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[1.2.0] - 2026-11-02

permittedScope(db, req, reply, orgIds, activity, view): the orgs of a list request the caller may act in, through the hooks; 403 only when none passes.

The list routes for users, roles, role settings, role, user and cross-org rules, delegations, permission profiles, user roles and activities checked only the first org of X-Org-Ids, then answered for every listed org. A caller allowed in the first org read the others' rows, and a caller refused in the first org got 403 for the whole list. They now answer for the permitted orgs only.
The unpinned org list, the stored org filter and readableOrgPaths decided with morbac.is_allowed in SQL, which skips the permission hooks. They now go through them, so an org the hooks refuse is never offered.

addPermissionHook('pre' | 'post', hook): application rules every permission decision runs. Hooks can only refuse; a throwing hook fails the decision.
isAllowed and permittedOrgs: the hooked decision without a reply, for one org or several.

hasPermission, hasPermissionAny, canPerform, canActOnUser, canGrantRule, the user listing and role assignment decide through isAllowed, so hooks apply to each.
The data proxy forwards only the X-Org-Ids the caller is allowed in, instead of every listed org once one passed. Rows are unchanged without hooks: RLS already hid the others.

First stable release of the Node.js companion to the pgmorbac PostgreSQL extension.
hasPermission and org-scope helpers backed by morbac.is_allowed.
withMorbacContext for running queries under the acting user so RLS applies.
PostgREST data proxy with per-route permissions and a hard page-size cap.
morbacMigrations() loader that ships the bundled extension SQL.
Fastify management routes for orgs, roles, rules, users, global rules, activities, and delegations.
PostgREST-style list-query parsing with allowlisted sort/filter columns.
JSON schema response fragments and shared domain types.
Unattributed org target: UNATTRIBUTED, OrgTarget and OrgSelection express a specific organisation, records with no org, or every org at once.
hasAnyPermission wraps the morbac.has_permission capability probe for UI gating.
withMorbacContext accepts an org selection, serialised to morbac.org_ids where a JSON null element names the unattributed bucket.