feat(objectql,plugin-security,core): the server answers current_user.can() in an option's visibleWhen - #20079

Merged

objectstack-fleet[bot] merged 9 commits into

mainfrom

claude/issue-18783-server-can-permissions

Sep 25, 2026

Commits on Sep 25, 2026

feat(objectql): answer current_user.can() in option visibleWhen from a passed permission map
claude
committed
9637703
feat: one effective object-permission map for /auth/me/permissions and the security service
claude
committed
07b0e53
test(objectql): pin the engine half of can() in option visibleWhen
claude
committed
2fe149f
test: pin the one effective-map producer from both ends
claude
committed
39341b8
chore: changeset for the server-side can() gate; keep core's new surface to what consumers import
claude
committed
8482914
Merge remote-tracking branch 'origin/main' into claude/issue-18783-server-can-permissions
claude
committed
b5416a2
test(plugin-security): drop the unread findOne double from the effective-map fixture
claude
committed
e215630
test(plugin-security): the effective-map fixture's find honours the caller's bound
claude
committed
f3fe6d6
fix(spec): repoint the allowExport liveness citation to where annotateEffectiveApiOperations now lives
claude
committed
7a6b091