Add atomic organization role administration

2026-09-03 22:51:53 -04:00
parent 17bd9453e2
commit fe6bd94c9a
13 changed files with 549 additions and 12 deletions
@@ -54,3 +54,9 @@ application concern belongs in the shared module.
  service now permits an explicit development port only when applications opt
  in and the RP ID is `localhost` or reserved `.test`; production origins keep
  the original portless default.
+- Gamertan's staff-access page exposed a dangerous composition gap between
+  individual grant/revoke calls. Foundations now owns one optimistic,
+  transactional direct-role replacement that preserves the final active
+  owner and appends its audit before commit. The application still owns route
+  authorization, role presentation, CSRF, and the exact fresh-passkey
+  operation binding.