ge-aerospace/shopdb-flask
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bump plugin contract to 0.32.0 and register new plugin tables

Browse Source 
Exports caller_is_role on the plugin authorization surface. Additive name, so a minor bump. Scoped personal tokens are always refused by it, matching require_role, which stops a plugin from accidentally letting a scoped token inherit role authority from its owner.

Registers the tables added by the endpoint lock and policy hold work (endpointlocks, policyactionholds) plus the endpoint health tables in the alembic template, so plugin migrations see them and the ownership guard does not report them as unclaimed.
This commit is contained in:
benjamin.baker
2026-09-07 12:40:12 -04:00
parent 0d5b9730e3
commit 4c1d96b6ba
6 changed files with 36 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
shopdb/__init__.py
View File

@@ -115,7 +115,13 @@ from .plugins import plugin_manager
# tab groups (serviceprocess, reports), a datetime column format, a map body
# key, and a tabs section that renders as a table. All optional, so a plugin
# that declares none of them is unaffected. Additive, minor bump.
__contract_version__ = '0.31.0'
# 0.32.0 adds caller_is_role to the authorization surface: the body-answering
# counterpart to require_role, for a route that serves everyone but treats one
# class of caller differently (admin break-glass override). Scoped personal
# tokens are always refused by it, matching require_role, so a plugin cannot
# accidentally let a scoped token inherit role authority from its owner.
# Additive name on the surface, minor bump.
__contract_version__ = '0.32.0'
# Product release version (see ADR-007). The product version and the
# plugin-contract version above are distinct series with independent