psa-systems/mokosh-server
Watch
9
0
Fork
You've already forked mokosh-server
 1
Code Issues Pull requests Projects Releases 10 Packages Wiki Activity Actions

feat(auth): single-tenancy admin floor on Bunyip RS path (PMS-447) #323

Merged
YousifShkara merged 1 commit from feat/PMS-447-single-tenancy-admin-default into main 2026-06-21 05:28:35 +02:00
Conversation 0 Commits 1 Files changed 1 +37 -25
YousifShkara commented 2026-06-21 05:28:31 +02:00
Owner
Copy link

After the single-tenancy pivot every Mokosh tenant has exactly one user (the owner), so a signed-in Bunyip user IS the admin of their own world by construction. JIT-created Bunyip users now default to Admin (was Technician) and the Bunyip claim reconciliation now floors subscriber (and unknown future claims) at Admin instead of keeping the local role. admin continues to map to SuperAdmin and the absent-claim path still leaves the local role unchanged so the legacy HS256 / standalone token paths are unaffected. Tests updated to assert the new floor; the existing super_admin-clamp behaviour is preserved.

#PMS-447

After the single-tenancy pivot every Mokosh tenant has exactly one user (the owner), so a signed-in Bunyip user IS the admin of their own world by construction. JIT-created Bunyip users now default to Admin (was Technician) and the Bunyip claim reconciliation now floors `subscriber` (and unknown future claims) at Admin instead of keeping the local role. `admin` continues to map to SuperAdmin and the absent-claim path still leaves the local role unchanged so the legacy HS256 / standalone token paths are unaffected. Tests updated to assert the new floor; the existing super_admin-clamp behaviour is preserved. #PMS-447
feat(auth): single-tenancy admin floor on Bunyip RS path (PMS-447)
Some checks failed
Create release / Create release from merged PR (pull_request) Has been skipped
Details
E2E / Playwright against staging (pull_request) Successful in 37s
Details
Check / fmt + clippy + compile + unit/doc tests (pull_request) Successful in 1m20s
Details
Integration / integration tests (pull_request) Failing after 5m54s
Details
8802de257c 
After the single-tenancy pivot every Mokosh tenant has exactly one user (the owner), so a signed-in Bunyip user IS the admin of their own world by construction. JIT-created Bunyip users now default to Admin (was Technician) and the Bunyip claim reconciliation now floors `subscriber` (and unknown future claims) at Admin instead of keeping the local role. `admin` continues to map to SuperAdmin and the absent-claim path still leaves the local role unchanged so the legacy HS256 / standalone token paths are unaffected. Tests updated to assert the new floor; the existing super_admin-clamp behaviour is preserved.

#PMS-447
YousifShkara deleted branch feat/PMS-447-single-tenancy-admin-default 2026-06-21 05:28:35 +02:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
YousifShkara
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
psa-systems/mokosh-server!323
No description provided.