All notable changes to this project are documented here. The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.
- Resolve scoped assignments through a
(subjectRef, scopeRef)index and fetch only assigned role definitions, avoiding full per-subject assignment and global role-table scans on access checks. - Treat Convex
_generatedoutput as CLI-owned, exclude it from formatting, and expose a dedicated codegen script. - Refresh all direct dependencies to their latest compatible releases for canary validation.
- Require
convex@^1.45.0and updateconvex-testto^0.0.56.
- Initial release of
@vllnt/convex-permissions— stored, runtime-editable role-based access control as a Convex component. Permissions<TRole, TAction>client class, generic over the host's role and action unions:defineRole,removeRole,assign,revoke,check,require,rolesFor,permissionsFor,listRoles.- Sandboxed
rolesandassignmentstables keyed by opaquesubjectRef/scopeRef; the host never reads them directly. - Wildcard grants (
"doc.*","*"), scoped / multi-tenant assignments, default-deny semantics, and a structuredConvexError<PermissionDenied>fromrequire. - Boundary validation of role names and subject refs.
- 100% end-to-end test coverage via
convex-testagainst the real component runtime.