Session-derived role default, GitHub issue templates, and ISC LICENSE (#245, #261, #257) - #364
Merged
Akatenvictor merged 10 commits intoAug 31, 2026
Conversation
`isRole` narrows an untrusted value to a known `Role`. `getRoleFromToken` does a best-effort, unverified read of the `role` claim (checking `role`, `user_role`, then a nested `user.role`) from the stored session JWT, returning null for an absent or unrecognised claim. Groundwork for AudioBitsStellar#245. Refs AudioBitsStellar#245
Top-level / fallback / nested claims, unknown role values, and malformed tokens. Refs AudioBitsStellar#245
…ed owner RoleProvider defaulted to `owner`, which PR_BODY flagged as unsafe for production. It now resolves the role as: explicit `initialRole` (tests / Storybook) > the session JWT's role claim > `viewer`. An unknown session is never treated as the workspace owner. `initialRole` keeps working as an explicit override so existing tests are unaffected. Refs AudioBitsStellar#245
Explicit override wins; session JWT role is adopted when no override is given; a role-less session falls back to `viewer` (not `owner`); the no-provider `useRole()` fallback stays `viewer`. Refs AudioBitsStellar#245
Adds a "Where the role comes from" section to RBAC.md and updates the `setRole()` note to point at it. Refs AudioBitsStellar#245
GitHub issue form capturing expected vs. actual, repro steps, the affected route/component, and environment. Refs AudioBitsStellar#261
GitHub issue form that asks for the problem/motivation before the proposed solution. Refs AudioBitsStellar#261
Keeps blank issues enabled and adds contact links to CONTRIBUTING.md and the backend repository. Refs AudioBitsStellar#261
Replaces the "no formal issue template yet" note with pointers to the bug report and feature request forms. Refs AudioBitsStellar#261
README notes the license file is missing. Adds an ISC LICENSE (matching the license used across the AudioBits repositories), sets `"license": "ISC"` in app/package.json, and updates the README's License section. Refs AudioBitsStellar#257
|
@bade22brazy Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
|
@bade22brazy is attempting to deploy a commit to the akatenvictor's projects Team on Vercel. A member of the Team first needs to authorize it. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three "Stellar Wave" issues. 10 commits, one logical unit each.
#245 —
fix: RoleProvider defaults to owner roleRoleContext.tsxhardcodedDEFAULT_ROLE = "owner", which the PR body flagged as unsafe for production.getRoleFromToken()(app/src/utils/jwt.ts) — best-effort, unverified read of theroleclaim from the stored session JWT (checksrole,user_role, then a nesteduser.role), reusing the existing payload-decode helper. Returnsnullfor an absent or unrecognised claim. NewisRole()type guard intypes/role.tsbacks the validation.RoleProvidernow resolves the role as: explicitinitialRoleprop (tests / Storybook / demo UIs) → session JWT role claim →"viewer". An unknown session is never treated as the workspace owner. AuseEffectadopts the session role if the token becomes readable just after mount.initialRoleis unchanged as an explicit override, so every existing<RoleProvider initialRole={…}>test (e.g.TopHeader.test.tsx) is unaffected.app/src/context/RBAC.md("Where the role comes from").jwt.test.ts(claim parsing / malformed tokens) andRoleContext.test.tsx(override wins, session role adopted, role-less session →viewernotowner, no-provider fallback).Signature verification is still out of scope — this only decides what the UI offers; the backend stays the real authorization check (consistent with the existing
getDisplayNameFromTokenand the RBAC.md security note).#261 —
docs: Add GitHub issue templatesCONTRIBUTING.mdnoted no formal issue template exists. Adds GitHub issue forms (.yml, matching current GitHub practice) under.github/ISSUE_TEMPLATE/:bug_report.yml— expected vs. actual, repro steps, affected route/component (so it's easy to find inapp/src/), environment.feature_request.yml— problem/motivation first, then proposed solution.config.yml— keeps blank issues enabled; contact links toCONTRIBUTING.mdand the backend repo.CONTRIBUTING.md"Reporting bugs / requesting features" updated to point at the forms.#257 —
docs: Add LICENSE fileREADME.mdexplicitly notes the license file is missing. Adds an ISC LICENSE — matching the license the siblingAudioBlock_Backendrepo already uses — sets"license": "ISC"inapp/package.json, and rewrites the README's License section to referenceLICENSEand the existingCODE_OF_CONDUCT.md. Copyright holder: "AudioBits", 2026. If the org prefers MIT/Apache-2.0, this is a one-file swap.Not built or run in this environment. All changes are TypeScript-typed (no
any), and the new tests follow the existing Vitest + RTL patterns (vi.mock("js-cookie"),data-testidprobes, theRoleProviderwrapping style fromTopHeader.test.tsx).Closes #245, closes #261, closes #257, Closes #164