Changelog

All notable changes to this package will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[1.1.0] - 2026-10-21

addPermissionHook('pre' | 'post', hook): application rules every permission decision runs. Hooks can only refuse; a throwing hook fails the decision.
isAllowed and permittedOrgs: the hooked decision without a reply, for one org or several.

hasPermission, hasPermissionAny, canPerform, canActOnUser, canGrantRule, the user listing and role assignment decide through isAllowed, so hooks apply to each.
The data proxy forwards only the X-Org-Ids the caller is allowed in, instead of every listed org once one passed. Rows are unchanged without hooks: RLS already hid the others.

First stable release of the Node.js companion to the pgmorbac PostgreSQL extension.
hasPermission and org-scope helpers backed by morbac.is_allowed.
withMorbacContext for running queries under the acting user so RLS applies.
PostgREST data proxy with per-route permissions and a hard page-size cap.
morbacMigrations() loader that ships the bundled extension SQL.
Fastify management routes for orgs, roles, rules, users, global rules, activities, and delegations.
PostgREST-style list-query parsing with allowlisted sort/filter columns.
JSON schema response fragments and shared domain types.
Unattributed org target: UNATTRIBUTED, OrgTarget and OrgSelection express a specific organisation, records with no org, or every org at once.
hasAnyPermission wraps the morbac.has_permission capability probe for UI gating.
withMorbacContext accepts an org selection, serialised to morbac.org_ids where a JSON null element names the unattributed bucket.