docs: start identity permission extraction

2026-08-30 18:03:58 +03:30
parent 7dcb9f58f1
commit fd72713d98
2 changed files with 7 additions and 1 deletions
@@ -301,6 +301,11 @@ The current composition root is `cmd/serve.go`; `repository.System` aggregates P
 - Added a domain-session `SessionStore` contract, infrastructure adapter over the legacy cache/persistence composition, and runtime wiring for IAM retrieval; full Auth tests pass in `d744ffc`. The adapter deliberately preserves existing Redis-expiry semantics without activating stricter status checks during the refactor.
 - Routed login and refresh-session persistence through the same application boundary with legacy fallback retained; full Auth tests and vet pass in `c15bcff`.
 - Added a distinct persistent `BySubject` session lookup and routed refresh-token rotation through it, deliberately keeping it separate from access-token Redis lookup so refresh validity is not capped by access expiry; full Auth tests and vet pass in `016d705`. A005 is complete; compatibility fallback removal remains under A008.
+
+### `A006` — identity and permission checkpoint
+
+- Extracted case-insensitive route/method evaluation and privileged-role detection into `application/permission`, retaining development-mode bypass and existing gRPC error mapping; focused and full Auth tests pass in `9f97cec`.
+- A006 remains in progress: permission repository wiring and identity application orchestration still need extraction.
 - A005 remains in progress: JWT validation, session checks, refresh-token flow, and broader authentication orchestration still need application ports and adapters.

 ### `I001` — publisher-backed ICO purchase map