feat(core): add generic permission map resolver with core utils and types gating infra

[grandmaester]

Summary

Foundation for permission-based UI gating: a generic, module-agnostic permission resolver plus the Member Management permission declarations that build on it.

This is PR 1 of 2 for the permission infrastructure. Follow-up: (2) PermissionProvider context, usePermissions hook and PermissionDeniedTooltip.

Why

Components currently gate mutations with a coarse binary readOnly prop. The MyOrganization API exposes granular per-resource permissions, so we're moving to fine-grained checks.

Two design goals shaped this revision:

1. Module-agnostic. Gating is not a My Organization concern — My Account and MFA step-up will need the same machinery, so the permissions module moved out from under my-organization/ to services/permissions/.
2. No repeated logic per module. Onboarding a new module should be a declaration, not another copy of the same hasPermission + readOnly wiring. Each module contributes a data-only permission map and touches no shared code.

What

packages/core

services/permissions/ (moved up from services/my-organization/permissions/)

• permission-map.ts — createPermissionResolver(spec) builds a resolver that turns granted scopes into named boolean flags. An array rule requires every scope; { any: [...] } requires at least one. readOnly (suppresses everything) and allowAll (used when no permission source is mounted) are applied centrally, so no call site repeats them. Return type is inferred from the spec, so a typo in a flag name is a compile error.
• permission-utils.ts — hasPermission, hasAnyPermission, hasAllPermissions (unchanged).
• permission-types.ts — trimmed to just OauthScope, the SDK-sourced union that keeps every scope string type-checked.

export const getMemberManagementPermissions = createPermissionResolver({
  canInvite: ['create:my_org:member_invitations'],
  canAssignRole: ['create:my_org:member_roles'],
  canRemoveRole: ['delete:my_org:member_roles'],
  canRemoveFromOrganization: ['delete:my_org:memberships'],
  canRevokeInvitation: ['delete:my_org:member_invitations'],
  // Resend revokes then recreates, so it needs both scopes.
  canResendInvitation: ['delete:my_org:member_invitations', 'create:my_org:member_invitations'],
  canShowMemberMenu: { any: ['create:my_org:member_roles', 'delete:my_org:memberships'] },
  canShowInvitationMenu: { any: ['delete:my_org:member_invitations'] },
} as const);

Packages

• packages/core
• packages/react
• examples

Testing

• This change adds unit test coverage
• Tested for both SPA and RWA flows, all example apps working
• All existing and new tests complete without errors

Checklist

• Breaking change
• Requires docs update
• Backward compatible

Contributing

• I have read the Auth0 general contribution guidelines
• I have read the Auth0 Code of Conduct

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 070f0240-2294-4281-80c8-ac4c1d0b9023

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Adds MyOrganization permission manifests, query keys, API types, public exports, and React utilities for permission checks and tier calculation. Core now consumes the packaged SDK tarball locally, and the utilities include Vitest coverage.

Changes

MyOrganization permissions

Layer / File(s)	Summary
Permission contracts and exports packages/core/src/services/my-organization/permissions/*, packages/core/src/services/my-organization/index.ts	Defines the permission manifest, derived permission type, query keys, API aliases, permission tiers, and barrel exports.
Permission evaluation utilities packages/react/src/lib/utils/my-organization/permission-utils.ts, packages/react/src/lib/utils/my-organization/__tests__/*	Adds permission presence checks and resource-based tier calculation with Vitest coverage.
Local SDK package wiring auth0-myorganization-js-1.1.0.tgz, packages/core/package.json	Adds the SDK tarball and changes the core dependency to a local file reference.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• auth0/auth0-ui-components#389: Changes overlapping MyOrganization service barrel exports.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately identifies the permission-based infrastructure, core utilities, and types added by the pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/permission-gating-infrastructure

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[grandmaester]

@coderabbitai Review the PR changes

[coderabbitai]

@grandmaester I’ll review the PR changes, including the permission manifest, SDK integration, public exports, and permission utility edge cases.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/core/package.json`:
- Line 55: Update the `@auth0/myorganization-js` dependency in packages/core so
the published package does not reference the repository-relative file: archive;
use the appropriate registry version or ensure packaging rewrites it to a
consumer-available dependency.

In `@packages/react/src/lib/utils/my-organization/permission-utils.ts`:
- Around line 65-73: Update getResourceVerbs to recognize only permissions with
exactly three segments matching <verb>:my_org:<resource>; require the namespace
segment to be my_org and reject trailing segments or other namespaces before
adding the verb.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 43807a54-afdf-4022-9646-d1e292e5f070

📥 Commits

Reviewing files that changed from the base of the PR and between 798a1f6 and d8094de.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (9)

• auth0-myorganization-js-1.1.0.tgz
• packages/core/package.json
• packages/core/src/services/my-organization/index.ts
• packages/core/src/services/my-organization/permissions/index.ts
• packages/core/src/services/my-organization/permissions/permission-manifest.ts
• packages/core/src/services/my-organization/permissions/permission-query-keys.ts
• packages/core/src/services/my-organization/permissions/permission-types.ts
• packages/react/src/lib/utils/my-organization/__tests__/permission-utils.test.ts
• packages/react/src/lib/utils/my-organization/permission-utils.ts