mca/parking_solution
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 10 Wiki Activity

docs(wiki): note log:read perm + entry presence/cooldown guard in reference pages

Browse Source 
Sync the two canonical reference pages with this session's features: local-jwt-auth
gains the new log resource / log:read permission in the RBAC grid (links app-logs);
first-run-setup notes the one-car-one-ticket presence-loop/cooldown guard the admin
configures on a relay (links entry-double-press).

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V
This commit is contained in:
Julian Çuni
2026-06-19 12:59:06 +02:00
parent 30e7fe85de
commit c0a775818b
2 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
wiki/concepts/first-run-setup.md
+5 -4
View File
@@ -8,10 +8,11 @@ updated: 2026-06-15
# First-Run Setup (device selection) # First-Run Setup (device selection)
The admin install flow that makes the system **device-agnostic in practice**: on first run, an The admin install flow that makes the system **device-agnostic in practice**: on first run, an
admin adds **controllers** (each declaring its relays — entry/exit/both — and the entry-button admin adds **controllers** (each declaring its relays — entry/exit/both — the entry-button
terminal) and then **readers/cameras/printers** bound to a controller relay, choosing from the terminal, and the one-car-one-ticket guard: a presence-loop input or a cooldown, see
[[device-registry]] catalog and entering each device's connection config. There is **no lane** — [[entry-double-press]]) and then **readers/cameras/printers** bound to a controller relay, choosing
the pool-of-spaces model; see [[entry-exit-points]]. from the [[device-registry]] catalog and entering each device's connection config. There is **no
lane** — the pool-of-spaces model; see [[entry-exit-points]].
> Implementation-derived (from `apps/server` + `apps/web`), not the source doc. > Implementation-derived (from `apps/server` + `apps/web`), not the source doc.
wiki/entities/local-jwt-auth.md
+3
View File
@@ -37,6 +37,9 @@ Authentication and authorization, kept **fully local** — a direct consequence
**last user holding admin** — administration can never be locked out of the appliance. **last user holding admin** — administration can never be locked out of the appliance.
- `event:void` is a permission, NOT a ledger delete: the append-only signed chain is untouched; the - `event:void` is a permission, NOT a ledger delete: the append-only signed chain is untouched; the
permission only gates who may APPEND a void event (there is no void API route yet — forward seam). permission only gates who may APPEND a void event (there is no void API route yet — forward seam).
- The grid is **extensible** — adding a feature adds its `resource:action` rows. Latest: **`log:read`**
(a new `log` resource) gates the diagnostic-log viewer (`GET /api/logs`); admin holds it, and it's
grantable to a diagnostic role. See [[app-logs]].
- **No privilege escalation through the RBAC system itself.** `role:create`/`role:update` and - **No privilege escalation through the RBAC system itself.** `role:create`/`role:update` and
`user:create`/`user:update` are themselves grantable, so a non-admin could otherwise self-escalate. `user:create`/`user:update` are themselves grantable, so a non-admin could otherwise self-escalate.
Guards (`routes/roles.ts`, `routes/users.ts`): a caller may only put permissions on a role that Guards (`routes/roles.ts`, `routes/users.ts`): a caller may only put permissions on a role that