V1 Web PWA · Surface walkthrough

Studio · Yemaya · RBAC

A per-surface walkthrough of the V1 Web PWA studio surface: layout, states, interactions, data, and cross-references.

walked
8sections2 minread
Markdown source
On this page

Context. surface studio · domain yemaya · route /studio/yemaya/rbac · auth signed-in + studio entitlement · source apps/oshun/web/src/app/studio/yemaya/rbac/page.tsx

Last walked. 2026-05-29 automated runtime walk (Playwright headless) — render, /v1 data (2xx), console/page-errors, expected content, screenshot verified; live screen-reader, touch, offline, and telemetry-delivery checks pending a manual AT pass. Evidence: WALKTHROUGH/results/runtime-sweep-2026-05-29.md; body re-derived 2026-06-03 from current source (lane-console architecture)

Purpose#

Admin lane console for role-permission resolution. It wires the real @yemaya/rbac role-permission engine via /v1/admin/yemaya/rbac: browse the built-in role templates and check whether a role holds a permission, with transitive inherits chains resolved into the role's effective permissions.

Entry points#

  • Breadcrumb chain on this page: Studio › Yemaya Auth › RBAC.
  • Reachable from the Studio index and from sibling Yemaya routes; also embedded as the RBAC Lane inside the Auth and Organizations aggregators.
  • Direct URL / bookmark (signed-in + studio entitlement).

Layout regions#

page.tsx renders ShellLayout active="studio" and:

  • Breadcrumbs panel (data-yemaya-rbac-breadcrumbs): Studio › Yemaya Auth › RBAC.
  • Workspace panel (StudioYemayaRbacWorkspace, data-yemaya-rbac-workspace):
    • <h1> "Yemaya RBAC Workspace" (WorkspaceHeading).
    • Summary paragraph (data-yemaya-rbac-summary).
    • The permission-check form lane (loading / unauthorized / error / ready-form / result, see States); data-yemaya-rbac-templates lists the built-in role template names.
  • Route Map panel (data-yemaya-rbac-route-map): <h2> "Route Map" + six STUDIO_YEMAYA_RBAC_ROUTE_MAP entries.
  • Quick-action panel: four quickAction links.

States#

  • Loading — data-yemaya-rbac-loading "Loading RBAC engine…" while the GET catalog fetch is in flight.
  • Unauthorized — data-yemaya-rbac-unauthorized "Access restricted." on a 401/403 admin-scope failure (fail-closed).
  • Error — data-yemaya-rbac-error "Could not load RBAC." on a non-OK / malformed catalog response.
  • Ready-form — data-yemaya-rbac-check-form once the catalog (builtInTemplates) resolves.
  • Result — data-yemaya-rbac-result with data-yemaya-rbac-verdict (granted / denied) and data-yemaya-rbac-effective (effective permissions); or a validation message data-yemaya-rbac-check-error.

Interactions#

  • "Studio" (link) → /studio
  • "Yemaya Auth" (link) → /studio/yemaya/auth
  • "RBAC" (current page) — aria-current="page".

Permission-check form (data-yemaya-rbac-check-form)#

  • Role definitions (JSON) — textarea data-yemaya-rbac-field-roles (aria-label "role definitions json"); JSON array of { name, permissions[], inherits? }.
  • Role — input data-yemaya-rbac-field-rolename (aria-label "role name").
  • Permission — input data-yemaya-rbac-field-permission (aria-label "permission").
  • Submit — button data-yemaya-rbac-check-submit "Check permission" → POST /v1/admin/yemaya/rbac/check with { roles, roleName, permission }.

Route map#

data-yemaya-rbac-route-map — six entries:

  • /studio/yemaya/rbac
  • /studio/yemaya/rbac/scenes/[sceneId]
  • /studio/yemaya/rbac/exports/[exportId]
  • /studio/yemaya/rbac/revisions/[revisionId]
  • /studio/yemaya/rbac/parity/[parityId]
  • /studio/yemaya/rbac/governance/[policyId]

Quick actions#

  • "Open Yemaya Auth workspace" → /studio/yemaya/auth.
  • "Open Yemaya Enterprise Plans workspace" → /studio/yemaya/enterprise-plans.
  • "Open Yemaya Compliance and Audit workspace" → /studio/yemaya/compliance-and-audit.
  • "Back to Studio workspace index" → /studio.

Data & contracts#

  • Reads: GET /v1/admin/yemaya/rbac (catalog: builtInTemplates) on mount.
  • Writes: POST /v1/admin/yemaya/rbac/check.
  • Realtime: none.
  • Caching: client fetch on mount, cache: 'no-store', buildBffAuthHeaders().
  • Auth/role check: admin-scoped fail-closed (401/403 → unauthorized state) behind the proxy studio gate.

Cross-references#

Open questions / known gaps#

  • The Route Map advertises scenes / exports / revisions / parity / governance sub-routes that the live permission-check lane does not expose.