fix(authorization): system principal regretion

2026-04-06 16:16:29 +02:00
parent 0e3b90af22
commit e653b38b88
3 changed files with 73 additions and 17 deletions
@@ -851,7 +851,7 @@ WHERE table_name = 'rules'

 ### Authorization Functions

-**`is_allowed(user_id, org_id, activity, view)`**: Main authorization decision. Returns BOOLEAN. Evaluates local rules, cross-org rules, user rules, and global rules; defaults to deny.
+**`is_allowed(user_id, org_id, activity, view)`**: Main authorization decision. Returns BOOLEAN. Evaluates local rules, cross-org rules, user rules, and global rules; defaults to deny. Cache writes are silently skipped in read-only transactions so this function is safe to call from both read-write and read-only contexts (e.g. PostgREST GET requests).

 ```sql
 SELECT morbac.is_allowed(user_uuid, org_uuid, 'read', 'documents');