diff --git a/PERMISSIONS.md b/PERMISSIONS.md index 221c5a0..3fb6d6f 100644 --- a/PERMISSIONS.md +++ b/PERMISSIONS.md @@ -216,6 +216,7 @@ grant assignment. #### Permission Inheritance +- **Writer**: inherited from parent B2B Organization, child B2B Organization - **Auditor**: inherited from parent B2B Organization, child B2B Organization, Project Membership Key Contact --- diff --git a/charts/lfx-platform/files/model.fga b/charts/lfx-platform/files/model.fga index 0d441dc..dc520ea 100644 --- a/charts/lfx-platform/files/model.fga +++ b/charts/lfx-platform/files/model.fga @@ -353,9 +353,11 @@ type b2b_org define owner: [user] # @fgadoc:jtbd Update org details & access settings # @fgadoc:jtbd Manage membership committee seat assignments - define writer: [user] or owner or global_org_admin - # auditor cascades transitively up and down the hierarchy via parent/child. - # writer does NOT cascade — edit scope stays on the directly-assigned org only. + define writer: [user] or owner or global_org_admin or writer from parent or writer from child + # writer and auditor both cascade transitively up and down the hierarchy via + # parent/child (LFXV2-3029) — an editor on any organization in a connected + # parent-child-sibling group is an editor on every member of that group, + # matching the auditor traversal below. # @fgadoc:jtbd View org details, settings & committee seats # @fgadoc:jtbd View org workspaces & workspace projects define auditor: [user, team#member] or writer or auditor from parent or auditor from child or key_contact from membership diff --git a/charts/lfx-platform/templates/openfga/model.yaml b/charts/lfx-platform/templates/openfga/model.yaml index 4cb78fa..7a6d7e1 100644 --- a/charts/lfx-platform/templates/openfga/model.yaml +++ b/charts/lfx-platform/templates/openfga/model.yaml @@ -28,7 +28,7 @@ spec: - version: major: 14 minor: 3 - patch: 0 + patch: 1 authorizationModel: | {{ .Files.Get "files/model.fga" | indent 8 }} {{- end }}