[SirLouen]

Part of #251. Supersedes #230 and #232.

What

• Roles and capabilities come from the shared role registry, goncierge. internal/role keeps only the core table: admin and member, with manage_users and manage_webhooks.
• Each plugin declares its roles under its own id with no admin rule. A new capability starts with the plugin id and a dot, and only the roles a plugin names carry it. A plugin under the id core is refused by make generate and at start.
• One registry is built per run and handed to authkit (login, admin and invites), the graph, the server's capability gate and the account commands, which read it through DeclaredRoles.
• sdk.RoleDeclaration is now goncierge.Role.
• authkit moves to 0.23.0, authkit/postgres to 0.15.0, gonsole/auth to 0.9.0 with gonsole/auth/postgres 0.2.0, and dbkit/postgres to 0.3.0. The account migrations and stores now come from gonsole/auth/postgres.
• account:enable refuses an account holding no role or one nothing declares, on a dry run too.
• AlphOne builds on Go 1.27.3, which fixes the crypto/x509 advisory GO-2026-6809.
• The graph answers an undeclared role with role_unknown and the meta field role, as the HTTP API does.

Why

authkit 0.19 and later check invites and admin writes against a role source. AlphOne's own copy of a registry could not be one, so the two dependency bumps failed. The shared registry replaces that copy.

Testing Instructions

1. GOWORK=off go test -race ./... and make e2e: every package and scenario passes.
2. alphone account:enable on an account holding no role, or a role nothing declares, is refused, on a dry run too.
3. A plugin declaring a capability without its id and a dot stops serve with an error naming the plugin.
4. Sign in as an admin: Users, role changes, invitations and webhooks work as before.

Summary by CodeRabbit

• New Features

  • Plugins can declare namespaced capabilities using the <plugin-id>.<name> format.
  • Custom plugin roles and capabilities work across account, invite, GraphQL, and webhook operations.
  • SDK role declarations use the shared role definition format.
  • The reserved core identifier is protected from plugin use.

• Bug Fixes

  • Account enablement rejects accounts without declared roles, including during dry runs.
  • Concurrent account role changes are detected before updates are written.
  • Unknown-role GraphQL errors identify the affected field.

• Documentation

  • Clarified plugin restrictions, capability validation, role assignment, and account command behavior.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: gopherium/AlphOne/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 39bf1fd5-e730-4ed3-b6b5-c152c18d803e

📥 Commits

Reviewing files that changed from the base of the PR and between 780d76a and 6aab2a7.

📒 Files selected for processing: 1

• go.mod

🚧 Files skipped from review as they are similar to previous changes: 1

• go.mod

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

📝 Walkthrough

The application replaces its local role registry with goncierge. Plugin role declarations and capability checks now use the shared registry across account commands, GraphQL authorization, and server scope enforcement. Tests, documentation, and dependencies were updated.

Changes: Role registry and authorization

Layer / File(s)	Summary
Role registry and SDK contract internal/role/*, sdk/*, .golangci.yml, go.mod	Core roles and capabilities now use goncierge registry types. The SDK aliases RoleDeclaration to goncierge.Role.
Plugin roles and application composition cmd/alphone/*, cmd/pluginwire/*, test/features/*, docs/src/content/docs/extending/commands.md, docs/src/content/docs/self-hosting/commands.md	Plugin roles use a shared registry. The reserved core plugin ID is rejected. Composition passes the registry to account, authentication, administration, invitation, graph, and server configuration.
GraphQL role authorization internal/graphres/*, internal/server/graphql_auth_test.go, docs/src/content/docs/reference/graphql-api.md	GraphQL identity data, role grants, account writes, invitations, and webhook authorization use the resolver registry. Unknown-role errors include field metadata.
GraphQL scope and server wiring graph/scope_test.go, internal/graphres/scope.go, internal/graphres/scopegate_test.go, internal/server/*	GraphQL scope checks evaluate string capabilities through the registry. Server configuration supplies the registry to GraphQL construction and scope enforcement.

Priority: ➖ Normal

Estimated code review effort: 4 (Complex) | ~60 minutes

Change: Refactor

Merge Risk: ⚪ Minimal · up to 6aab2

No blocking regression is demonstrated by the supplied change; merge after normal validation.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 44.04% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 109 functions across 43 files. (1 skipped…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title accurately summarizes the main changes: adopting the shared role registry and upgrading to authkit 0.23.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 44.04% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 109 functions across 43 files. (1 skipped: 1 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[greptile-apps]

Confidence Score: 5/5

[Medium impact] No identified issue blocks merging. This assessment does not establish that the full test suite passes.

Summary

Replaces the private role registry with goncierge and shares it across account commands, authentication, GraphQL, and capability checks.

• Plugins and core roles now share one registry across each run.
• GraphQL checks role access through the shared registry.
• Account commands use declared roles and refuse roleless accounts.

_{Reviews (3) · Last reviewed commit: "chore(deps): build on Go 1.27.3 for the ..." · Reviewed by Greptile}

[gitar-bot]

Code Review ✅ Approved

🔴 High risk · Moving authorization to the shared role registry lets plugin-declared roles carry manage_users; a mistaken declaration could grant account-management access.

Replaces the local role registry with the shared goncierge registry, hands one registry to authkit, the graph, the server capability gate and account commands, and bumps authkit and related dependencies. No issues found.

Verification

Rules No rules evaluated

Functional validation Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source}

[codescene-access]

Code Health Improved (4 files improve in Code Health)

Gates Passed
4 Quality Gates Passed

See analysis details in CodeScene

View Improvements

File	Code Health Impact	Categories Improved
role_test.go	9.92 → 10.00	Bumpy Road Ahead
graphql.go	9.69 → 10.00	Excess Number of Function Arguments
run.go	8.86 → 8.93	Bumpy Road Ahead
world_test.go	9.46 → 9.51	Complex Method, Large Method

Quality Gate Profile: Clean Code Collective
Install CodeScene MCP: safeguard and uplift AI-generated code. Catch issues early with our IDE extension and CLI tool.