marc
fa7567f5f0
Adds a first-class org target vocabulary shared by every rule kind: a specific organization, unattributed (objects whose org is NULL), or all. A role can now be granted the unassigned pile without a global rule. - rules.scope gains 'unattributed' and 'all' - user_rules.org_id accepts NULL to target unattributed objects - org_in_scope partitions the classes: 'unattributed' matches only a NULL target, tree scopes never match one - has_permission(user, activity, view) capability probe for UI gating - current_org_filter() parses morbac.org_ids once into org UUIDs plus the unattributed-bucket flag (a JSON null element requests it) - rls_check split by arity so NULL never carries two meanings: rls_check(activity, view) for tables with no org column, rls_check(activity, view, row_org_id[, row_user_id]) where a NULL row_org_id means the record is unattributed - detect_rule_conflicts is scope-aware, so rules targeting different object sets no longer collide Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2.8 KiB
2.8 KiB
Changelog
All notable changes to this project will be documented in this file.
The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.
0.1.0 - 2026-02-19
Added
- Initial release of Multi-OrBAC PostgreSQL extension
- Complete Multi-OrBAC implementation based on CNRS research paper
- Core features:
- Organization-centric access control
- Role-based abstraction with organizational scope
- Activity and view abstractions
- Context-based rule evaluation
- Four deontic modalities (permission, prohibition, obligation, recommendation)
- Prohibition precedence over permissions
- Multi-organization support
- Advanced features:
- Organization, role, activity, and view hierarchies with transitive closure
- Temporal delegation with time bounds
- Temporal constraints on rules with validity periods (valid_from, valid_until)
- Negative role assignments
- Separation of Duty (SoD) constraints
- Role cardinality constraints (min/max users)
- Derived roles (computed via functions)
- Cross-organizational rules with temporal support
- Administration rules (meta-policies)
- Audit logging for security-critical operations
- Audit logging system:
- Generic audit trigger for tracking INSERT/UPDATE/DELETE operations
- Comprehensive audit log with JSONB support for before/after states
- Helper functions:
enable_audit(),disable_audit() - Field-level change tracking
- Client connection metadata capture (IP, application name, session user)
- Policy DSL with idempotent compiler
- RLS helper functions for PostgREST integration
- Comprehensive test suite with 20 test scenarios
- Complete documentation
- Build and installation automation (Makefile, install.sh)
- Unattributed (no-org) object support:
- Org target vocabulary shared by every rule kind: a specific organization,
unattributed(objects with no org), orall(every org, unattributed included) rules.scopevaluesunattributedandalluser_rules.org_idaccepts NULL to target unattributed objectsorg_in_scope()partitions the two object classes:unattributedmatches only a NULL target, tree scopes never match onemorbac.has_permission(user, activity, view)capability probe for UI gatingmorbac.current_org_filter()parsesmorbac.org_idsonce into org UUIDs plus the unattributed-bucket flag (a JSONnullelement requests it)rls_check()split by arity so NULL never carries two meanings:rls_check(activity, view)for tables with no org column,rls_check(activity, view, row_org_id[, row_user_id])for row-scoped tables where a NULLrow_org_idmeans the record is unattributed
- Org target vocabulary shared by every rule kind: a specific organization,