Ledger

WEB-029

DB RBAC: staff, 9 roles, permission catalogue (risk, AAL2, approval), has_perm/require_perm/current_staff + role matrix pgTAP

← Ledger

donestatus · web-db

1✓ tests passed / failed

4.57Mtokens · 2 min

0evidence files

Evidence

From logs/evidence/WEB-029/. Click a thumbnail for the full image.

No evidence files in logs/evidence/WEB-029/.

Tests

pass pgTAP surface + RBAC matrix (AAL2, disabled, non-staff) · 24.7 s · raw log$ node packages/db/scripts/sb.mjs db reset && pnpm db:test

Notes

2026-10-04 14:06 UTC · Migration 20261004140100_admin_rbac: roles (9), permission catalogue (66 keys with module, risk, requires_aal2, requires_approval for compensation/grants), role_permissions matrix from the plan, staff + staff_roles (FK auth.users), has_perm (active + AAL2), require_perm (42501), current_staff() (any AAL, own row only), read policies, api.health(). pgTAP 020_rbac 14 checks; test helpers need explicit grants because of the role-wide PUBLIC revoke.