eagraiclainne/app

Watch

Fork 0

feat: sub-verb matrix rows, child standalone jobs, pinned sheet errors (ADR-0031) #89

Merged

nalum merged 9 commits from feat/matrix-sub-verbs into main

2026-08-16 12:41:08 +00:00

nalum commented

2026-08-16 11:59:12 +00:00

Owner

Stacked on #88 (merge that first; Forgejo retargets this to main).

A child testing the Android app saw the New job button, pressed Save, and got "Not authorized to create an item outside a list". The button read the ItemService/Create matrix row, but the standalone-vs-in-list rule lived only as a hard-coded role check inside the handler — invisible to GetPermissionMatrix, so web and Android both showed an affordance the server refused.

ADR-0031: sub-verb matrix entries. A role-only resource guard inside a handler now gets a dotted matrix row. The handler consults it via roles.CheckPermission, GetPermissionMatrix serves it, and clients gate the affordance on it — one row, no drift. Two rows land here:

ItemService/Create.standalone (Admin, Member, Child) — who may mint a job outside a list. Policy change: children may now create standalone jobs.
ItemService/AssignUser.other (Admin, Member) — who may set a job's owner to someone other than themselves. AssignUser reads it in place of its hard-coded check, and Create now enforces it when owner_uid rides the request. That closes a real hole: with standalone create open to children, the owner riding the create bypassed the ADR-0014 take-only guard entirely — a child could mint a job assigned to anyone.

Clients follow the rows: New job appears exactly when Create.standalone allows it, and the owner picker offers only Me to takers, so the form can never stage a create the server refuses.

Pinned sheet errors. The same testing session showed failure banners clipping off the top of scrolled sheets. The web Sheet grew an error slot rendered with the footer, and 18 sheet forms hand their banner there (three needed error state hoisted out of child components). Android moved ErrorLine beside the action row in 14 bottom-sheet forms. The message now appears next to the buttons that caused it.

Verified: make check green, Android assembleDebug green, deployed to the kind cluster and exercised — the live server serves both sub-verb rows, and the child flow was retested on-device.

🤖 Generated with Claude Code

Stacked on #88 (merge that first; Forgejo retargets this to main). A child testing the Android app saw the New job button, pressed Save, and got "Not authorized to create an item outside a list". The button read the `ItemService/Create` matrix row, but the standalone-vs-in-list rule lived only as a hard-coded role check inside the handler — invisible to `GetPermissionMatrix`, so web and Android both showed an affordance the server refused. **ADR-0031: sub-verb matrix entries.** A role-only resource guard inside a handler now gets a dotted matrix row. The handler consults it via `roles.CheckPermission`, `GetPermissionMatrix` serves it, and clients gate the affordance on it — one row, no drift. Two rows land here: - `ItemService/Create.standalone` (Admin, Member, Child) — who may mint a job outside a list. Policy change: children may now create standalone jobs. - `ItemService/AssignUser.other` (Admin, Member) — who may set a job's owner to someone other than themselves. `AssignUser` reads it in place of its hard-coded check, and `Create` now enforces it when `owner_uid` rides the request. That closes a real hole: with standalone create open to children, the owner riding the create bypassed the ADR-0014 take-only guard entirely — a child could mint a job assigned to anyone. Clients follow the rows: New job appears exactly when `Create.standalone` allows it, and the owner picker offers only Me to takers, so the form can never stage a create the server refuses. **Pinned sheet errors.** The same testing session showed failure banners clipping off the top of scrolled sheets. The web `Sheet` grew an `error` slot rendered with the footer, and 18 sheet forms hand their banner there (three needed error state hoisted out of child components). Android moved `ErrorLine` beside the action row in 14 bottom-sheet forms. The message now appears next to the buttons that caused it. Verified: `make check` green, Android `assembleDebug` green, deployed to the kind cluster and exercised — the live server serves both sub-verb rows, and the child flow was retested on-device. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

nalum added 9 commits

2026-08-16 11:59:12 +00:00

feat(auth): drive standalone job create from a matrix sub-verb 14b5347edd

The New job affordance was gated on ItemService/Create, but the
standalone-vs-in-list rule lived only as a hard-coded role check inside
the handler — invisible to GetPermissionMatrix, so both web and Android
showed a child the button and the server then refused. The rule now
lives in the matrix as a Create.standalone sub-verb entry: the handler
consults it, GetPermissionMatrix serves it, and clients gate on it — one
source of truth, no drift (ADR-0031).

Policy also changes: CHILD joins the sub-verb entry, so children may now
mint standalone jobs, not only list entries and steps under their own
jobs.

feat(web): gate New job on the Create.standalone sub-verb 3c4496fc3e

The button was gated on ItemService/Create, which CHILD passes for
in-list creation — so a child saw New job and then hit the server's
standalone guard. Reading the sub-verb entry keeps the affordance and
the guard on the same matrix row (ADR-0031).

feat(android): gate New job on the Create.standalone sub-verb 10d87e1984

Same fix as the web reference: the button read ItemService/Create,
which CHILD passes for in-list creation, so a child saw New job and the
server refused the standalone create. The sub-verb entry (ADR-0031) is
the row the server guard reads, so the affordance now matches it.

docs(adr): record sub-verb matrix entries (0031) a61d55504b

ADR-0031: a role-only resource guard inside a handler is named in the
PermissionMatrix as a sub-verb entry (ItemService/Create.standalone) so
the guard, GetPermissionMatrix and every client affordance read the one
row. The first entry also flips policy: CHILD may now create standalone
jobs.

feat(auth): guard assign-to-other with a matrix sub-verb 411169d218

Opening standalone create to children exposed a hole: the owner rides
CreateItemRequest, so the ADR-0014 take-only guard in AssignUser never
ran and a child could mint a job assigned to anyone. The role list for
'may hand a job to someone else' now lives as the AssignUser.other
sub-verb row (ADR-0031); AssignUser reads it in place of its hard-coded
Admin/Member check, and Create enforces it whenever owner_uid names
someone other than the requester. The self-vs-other comparison stays in
the handlers — it needs the requester's identity, which a matrix row
cannot express.

feat(web): offer only Me in New job's owner picker for takers 10067ab805

The picker read from the assignable family list regardless of role, so
a child could stage a job for someone else and only learn at Save that
the server refuses. The AssignUser.other sub-verb row (ADR-0031) now
decides who sees other marks — takers get just their own, matching what
the create will accept.

feat(android): offer only Me in New job's owner picker for takers 7479c57f73

Same fix as the web reference: the AssignUser.other sub-verb row
(ADR-0031) decides who sees other members' marks in the New job owner
picker — takers get just their own, matching what the create accepts.

fix(web): pin form errors to the sheet footer de859c63f9

A failure banner at the top of a sheet body scrolls out of view — on a
long form the user presses Save at the bottom and the answer renders
where they are not looking, clipped by the scroll (seen on New job).
Sheet grows an error slot pinned with the footer, and every sheet form
hands its banner there instead of the body top: the message appears
beside the buttons that caused it, always visible.

fix(android): pin form errors beside the sheet actions

check / commits (pull_request) Successful in 8s

Details

check / web (pull_request) Successful in 1m39s

Details

check / go (pull_request) Successful in 2m42s

Details

check / report (pull_request) Successful in 3s

Details

android / build (pull_request) Successful in 5m36s

Details

android / report (pull_request) Successful in 4s

Details

1261818adc

The web reference just moved sheet-form failure banners out of the
scrollable body and down to the action row, so the message appears
beside the buttons that caused it instead of clipped off the top
(seen on New job). The Compose bottom-sheet forms follow: ErrorLine
moves from under the heading to just above each form's action row.

forgejo-actions commented

2026-08-16 12:01:58 +00:00

Test report

Suite	Tests	Result	Skipped
Unit	1332	✅ pass	1
Integration	83	✅ pass	—

Coverage: 27.6%

_{Updated by the check workflow · commit 8b66ab9746}

## Test report | Suite | Tests | Result | Skipped | | --- | --: | --- | --: | | Unit | 1332 | ✅ pass | 1 | | Integration | 83 | ✅ pass | — | **Coverage:** 27.6% <sub>Updated by the check workflow · commit 8b66ab97466f69bca00370eb60d681db557fe8bb</sub>

forgejo-actions commented

2026-08-16 12:04:53 +00:00

Android test report

Suite	Tests	Result	Skipped
Unit (debug)	31	✅ pass	0

_{Updated by the android workflow · commit 8b66ab9746}

## Android test report | Suite | Tests | Result | Skipped | | --- | --: | --- | --: | | Unit (debug) | 31 | ✅ pass | 0 | <sub>Updated by the android workflow · commit 8b66ab97466f69bca00370eb60d681db557fe8bb</sub>

nalum force-pushed feat/matrix-sub-verbs from 1261818adc

check / commits (pull_request) Successful in 8s

Details

check / web (pull_request) Successful in 1m39s

Details

check / go (pull_request) Successful in 2m42s

Details

check / report (pull_request) Successful in 3s

Details

android / build (pull_request) Successful in 5m36s

Details

android / report (pull_request) Successful in 4s