- Publish the compiled member-token catalog as pact.MemberTokenScopeCatalog
- Imply declared names only when the MCP subject has a ClientID
- Reject a bad Implies and the reserved names backend and offline_access
MCPUserGuard.MCPDispatch now sets the in-memory credential's ID to the
subject's TokenID when the subject came from a personal usr_ token (no
ClientID), so a handler running under MCP dispatch can record which
token made a change. An OAuth subject's TokenID names the OAuth
server's token row, so its credential keeps ID 0. The credential is
still never saved.
- AccessRevokedEvent and FireAccessRevoked: fired in the write's transaction
by the ban action (newly banned users only), the password reset, an
administrator setting a password and the self-service password change;
a revoked subject event per user after commit
- LinkedBackendUser answers no administrator for a banned user
- FireSubjectEvent / FireSubjectEventAfterCommit carry TokenID or ClientID;
DELETE /tokens/{id} ends only that token's MCP sessions
- the MCP personal-token path stamps last_used_ip from towel.ClientIP
- BackendLinksFor replaces the duplicate lookups; requestUsable uses
IsUsableAt
- classes.FrontendPermissionCatalog: the seeded rows, then codes activated
plugins declare through pact.HasFrontendPermissions (seeded row wins);
both permission editors offer it
- classes.MCPUserGuard (guard "user"): reads user.api_token, user.scope:*
and user.permission:*, allows with the route's checks (session scopes,
group grants, every code), dispatches with an in-memory token credential,
resolves usr_ personal tokens; registered in *pact.MCPGuards and published
as pact.MCPPersonalTokenResolver
- GET /_user/api/v1/token/me (user.api_token, user.scope:read) and the MCP
tool me (user_me)
- pact.MCPSubjectChanged on token revoke, Users saves and User Groups saves
and deletes
