-
Notifications
You must be signed in to change notification settings - Fork 87
Implement a deterministic permission inheritance resolver with conflict detection #379
Copy link
Copy link
Open
Labels
GrantFox OSSGrantFox Open Source Sponsorship program tagGrantFox Open Source Sponsorship program tagMaybe RewardedIssue may qualify for a reward upon successful completion per campaign rulesIssue may qualify for a reward upon successful completion per campaign rulesThird CampaignOfficial FWC26 campaign issue — eligible for campaign scoring and rewardsOfficial FWC26 campaign issue — eligible for campaign scoring and rewardsaccess-controlAccess evaluation, permissions, authorisation rules, and protected resource logicAccess evaluation, permissions, authorisation rules, and protected resource logicbackendBackend services, application logic, persistence integration, and server-side functionalityBackend services, application logic, persistence integration, and server-side functionalityexpertExpert difficulty tasks requiring deep expertise and architectural decision-makingExpert difficulty tasks requiring deep expertise and architectural decision-makingrolesBuilt-in and custom roles, role definitions, assignments, and community role managementBuilt-in and custom roles, role definitions, assignments, and community role management
Description
Activity
Metadata
Metadata
Assignees
Labels
GrantFox OSSGrantFox Open Source Sponsorship program tagGrantFox Open Source Sponsorship program tagMaybe RewardedIssue may qualify for a reward upon successful completion per campaign rulesIssue may qualify for a reward upon successful completion per campaign rulesThird CampaignOfficial FWC26 campaign issue — eligible for campaign scoring and rewardsOfficial FWC26 campaign issue — eligible for campaign scoring and rewardsaccess-controlAccess evaluation, permissions, authorisation rules, and protected resource logicAccess evaluation, permissions, authorisation rules, and protected resource logicbackendBackend services, application logic, persistence integration, and server-side functionalityBackend services, application logic, persistence integration, and server-side functionalityexpertExpert difficulty tasks requiring deep expertise and architectural decision-makingExpert difficulty tasks requiring deep expertise and architectural decision-makingrolesBuilt-in and custom roles, role definitions, assignments, and community role managementBuilt-in and custom roles, role definitions, assignments, and community role management
Difficulty: Expert
Type: Feature
Recommended labels (if available in this repo): roles, access-control, backend, expert
Background
GuildPass communities may eventually support roles that inherit permissions from other roles. Inheritance is useful, but it introduces graph complexity, ambiguity and the possibility of cycles.
This issue introduces a pure role-permission inheritance resolver that can be implemented independently of role persistence, membership services and API routes.
Problem
There is currently no reusable Core primitive for resolving effective permissions across an inheritance graph.
A naive recursive implementation can loop forever on cycles, double-count permissions, or produce inconsistent results when multiple inheritance paths converge.
Expected Outcome
Implement a deterministic resolver that calculates the effective permission set for a role based on its directly assigned permissions and inherited parent roles.
Suggested Implementation
Represent roles with structures similar to:
The resolver should:
Optional deny semantics may be introduced only if they are explicitly modelled and documented rather than inferred from naming conventions.
Acceptance Criteria
pnpm typecheckpasses.pnpm buildpasses.pnpm testpasses.Likely Affected Files/Directories
Independence Requirement
This issue must be independently implementable from the current
mainbranch and must not depend on role persistence or another campaign issue.