[obany]

📝 Description

Adds role-based authorization to the node and makes it a required component. User scopes are replaced by authorization roles, default RBAC policies are seeded from the REST route declarations on every startup, and existing users are migrated from scopes to roles. Nodes now fail to start with node.migrationAuthorizationComponent unless an authorization connector is configured.

TWIN_AUTHORIZATION_CONNECTOR="entity-storage"

🔄 Type of Change

• 🐛 Bug fix (non-breaking change which fixes an issue)
• ✨ New feature (non-breaking change which adds functionality)
• 💥 Breaking change (fix or feature that would cause existing functionality to not work as expected)
• 📚 Documentation update
• ⚡ Performance improvement
• ♻️ Code refactoring
• 📦 Dependencies update

🛠️ Changes Made

• Added configureAuthorization to engineEnvBuilder, registering the entity storage or Casbin authorization connector and the authorization service, and throwing when TWIN_AUTHORIZATION_CONNECTOR is not set
• Added the TWIN_AUTHORIZATION_* and TWIN_CASBIN_* environment variables, including TWIN_AUTHORIZATION_MODEL and TWIN_AUTHORIZATION_MODEL_MODE (merge or replace) for supplying a custom authorization model
• Added seedAuthorizationDefaults, which runs after startup and derives policies and role inheritances from each route's defaultAuthorization, falling back to user:read and user:write by HTTP verb, across all tenants in multi-tenant mode
• Added default roles in defaults.ts: global-admin, tenant-admin, user-admin, identity-admin, identity-profile-admin, devops and user, with global-admin inheriting every role and every other role inheriting user
• Registered the Authorization REST and socket route processors whenever authorization is configured, with TenantOverride now added only in multi-tenant mode
• Added a schema migration that converts the removed scope property on AuthenticationUser into authorization role assignments
• Replaced the --scope option with --roles on the user-create and user-update commands, and changed user-get, org-users-list and bootstrap-dev to read roles from the authorization component
• Replaced TWIN_ADMIN_USER_SCOPE with TWIN_ADMIN_USER_ROLES for bootstrap-dev and the soak harness
• Identity profile service now uses authorizationModelId and escalatedPrivilegeRole, and the obsolete TWIN_IDENTITY_PROFILE_ADMIN_SCOPES variable has been removed
• Added TWIN_WEB_SERVER_TYPE (fastify, hono or native) and TWIN_AUTH_MIN_PASSWORD_LENGTH / TWIN_AUTH_MAX_PASSWORD_LENGTH
• Backfilled missing variables across the .env.example-* files and removed stale ones
• Added the authorization-defaults.mdx architecture article with role hierarchy and permission diagrams, and updated node-env-variables.mdx
• Added the @3sixty/authorization-models dependency and removed unused dependencies from node-core and node

🧪 Testing

• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• I have tested this change manually
• Testing not required for changes