quazardous/qdadm @quazardous/qdadm@2.24.0

on GitHub

Minor Changes

• 71e8c55: A security.grant judge that loads its answers can hold the first navigation: ready() (#2412).

  Reloading an entity page with a backend-judged app landed on the home page with "Access Denied": the first navigation starts inside createApp(), before the judge's request can answer, and its cache miss fell through to an empty role matrix. The documented workaround — fetching before createApp() — could not work either: the judge's install() runs inside createApp().

  grant: {
    isGranted: (attribute) => answers.get(attribute),
    ready: () => loading, // the load in progress
  }

  The route guard now waits for ready() on entity routes before deciding. It still fails closed: a rejection, or no settling within security.readyTimeoutMs (10 s by default), denies the navigation with a console error naming the judge. Judges without ready() behave exactly as before, synchronously.

  The security docs replace the pre-warm example with one that works: load on kernel:ready and auth:login, and return that load from ready().

Patch Changes

• afaa862: ROLE_ANONYMOUS stays undeletable when RolesManager is given another idField (#2406).

  The protection read the role code from name only, so an app keeping roles behind its own API with new RolesManager({ storage, idField: 'id' }) silently lost it: the UI offered to delete ROLE_ANONYMOUS like any other role. It now reads name and the idField value.

  The security docs now describe RolesManager as what it is — the roles system entity — including how to keep it on your own storage, and why system is set by the framework's managers, not by apps.