Studio · Yemaya · Organization Management

Purpose#

Admin lane console wired to the @yemaya/rbac shipped role hierarchy: pick a scope (system / organization / project / team) and a built-in role to resolve its effective permissions (with inheritance), or check whether a single capability is granted to that role.

Entry points#

• Studio index quick-actions.
• No breadcrumb panel on this page.
• This page links out to /studio/yemaya/developer-sdks.
• Embedded as a lane inside /studio/yemaya/enterprise.
• Direct URL / bookmark (signed-in + studio entitlement).

Layout regions#

page.tsx renders ShellLayout active="studio" and:

• Workspace panel (StudioYemayaOrganizationManagementWorkspace, data-yemaya-organization-management-workspace):
  • <h1> "Yemaya Organization Management Workspace".
  • Summary <p data-yemaya-organization-management-summary> (resolve the shipped role hierarchy to effective permissions).
  • Role Hierarchy Operations Lane — <h2 data-yemaya-om-lane-heading> with loading / unauthorized / error / ready-form / result; scope + role selects, a resolve form, and a check form.
• Route Map panel (data-yemaya-organization-management-route-map): <h2> "Route Map" with five entries.
• Quick-action panel: two quickAction links.

States#

• Loading — data-yemaya-om-loading ("Loading RBAC engine…").
• Unauthorized — 401/403 → data-yemaya-om-unauthorized with reason "Yemaya workspace scope required to inspect the role hierarchy.".
• Error — non-OK / malformed catalog → data-yemaya-om-error.
• Ready-form — catalog (summary, scopes[]) loaded; the scope <select> drives the role <select> options.
• Resolve result — 200 → data-yemaya-om-resolve-result with data-yemaya-om-resolve-headline and data-yemaya-om-permissions (each data-yemaya-om-permission-row); failure → data-yemaya-om-resolve-error.
• Check result — 200 → data-yemaya-om-check-result with data-yemaya-om-check-verdict (granted/denied); empty permission or failure → data-yemaya-om-check-error.

Interactions#

Role Hierarchy Operations Lane#

• Scope — <select data-yemaya-om-scope> from catalog.scopes; selecting a scope resets the role to that scope's first role.
• Role — <select data-yemaya-om-role> from the selected scope's roles.

Resolve form (<form data-yemaya-om-resolve-form>):

• "Resolve effective permissions" submit (data-yemaya-om-resolve-submit) — POSTs { scope, role } to the resolve endpoint.

Check form (<form data-yemaya-om-check-form>):

• Permission to check — <input data-yemaya-om-permission> (aria-label "permission", e.g. asset:delete).
• "Check capability" submit (data-yemaya-om-check-submit) — POSTs { scope, role, permission } to the check endpoint.

Route map#

data-yemaya-organization-management-route-map — five entries:

• /studio/yemaya/organization-management
• /studio/yemaya/organization-management/scenes/[sceneId]
• /studio/yemaya/organization-management/exports/[exportId]
• /studio/yemaya/organization-management/revisions/[revisionId]
• /studio/yemaya/organization-management/governance/[policyId]

Quick actions#

• "Open Yemaya Developer SDKs workspace" → /studio/yemaya/developer-sdks.
• "Back to Studio workspace index" → /studio.

Data & contracts#

• Reads: GET /v1/admin/yemaya/organization-management (catalog; summary, scopes[] with per-scope roles) on mount with buildBffAuthHeaders(), cache: 'no-store'.
• Writes:
  • POST /v1/admin/yemaya/organization-management/resolve → { result: { scope, role, description, inherits, permissions[], permissionCount } }.
  • POST /v1/admin/yemaya/organization-management/check → { result: { scope, role, permission, granted } }.
• Realtime: None.
• Caching: client fetch on mount, no-store; aborted on unmount.
• Auth/role check: admin-scoped, fail-closed; route additionally signed-in + studio via the proxy gate.

Cross-references#

• Workspace source: apps/oshun/web/src/components/studio/StudioYemayaOrganizationManagementWorkspace.tsx
• Route map source: apps/oshun/web/src/components/studio/StudioYemayaOrganizationManagementRouteMap.ts
• Page source: apps/oshun/web/src/app/studio/yemaya/organization-management/page.tsx
• Embedded in: studio-yemaya-enterprise.md
• Studio overview: studio-overview.md
• Feature spec: V1/features.md

Open questions / known gaps#

• The lane resolves/inspects the shipped role hierarchy but cannot mutate it (no create/edit role path); confirm whether role authoring is planned for this route.
• Route-map children (scenes/exports/revisions/governance) are a sitemap contract; confirm which dynamic pages exist.