Commit Graph
3 Commits
Author SHA1 Message Date
weichenandCursor a56d033d3c feat(web): fail-closed capabilities and admin roles from server API
Stop persisting roles to localStorage as authority; AdminSettingsModal reads
and writes role matrices via /api/v1/admin/roles; hasPermission denies when
capabilities are not loaded from /auth/me.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-13 02:50:22 +00:00
weichen d612c1193e fix(web): remove identity simulation and stop sending X-User-ID
Product UI no longer switches sessions locally; API clients attach Bearer
tokens only and LocalAuthClient stays test-only outside the prod bundle.
2026-09-13 02:50:22 +00:00
WeiCHENandCursor aef1d79060 docs(test): archive auth and dual settings test report
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-13 02:50:20 +00:00