allagroup/alla-allaos-fullstack
Template
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

task-c.1

Browse Source
This commit is contained in:
phaichayon
2026-06-22 15:49:31 +07:00
parent 1b901efc51
commit 3f28fde39f
36 changed files with 2602 additions and 56 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
docs/security/team-scope-limitations.md
View File

@@ -22,14 +22,14 @@ That means the system does **not** currently know:
Because of that, `team` currently behaves as an approximate operational scope rather than a strict org-chart scope.
## Contact Sharing Limitation
## Contact Sharing Status
The production schema currently has no persisted contact-sharing table.
The production schema now includes persisted contact sharing.
Result:
- contact visibility is enforced through customer ownership plus contact creator visibility
- mock/demo shared-contact behavior from legacy demo data is not part of the production boundary yet
- contact visibility is enforced through customer ownership, contact creator visibility, and explicit contact-share grants
- cross-owner contact access can now be granted and revoked without relying on demo/mock behavior
## Future Team Hierarchy Model
@@ -37,5 +37,5 @@ Recommended future direction:
1. add a first-class manager/team relationship model
2. resolve `team` scope from that relationship instead of permissive approximation
3. add explicit contact-sharing persistence if the business still requires cross-owner contact access
3. keep expanding security fixtures around owner/share behavior once a first-class team graph exists
4. expand runtime security fixtures around manager-team boundaries after real hierarchy data exists