feat(permissions): add permission manifest constant, types utilities, my-org tarball

[grandmaester]

Summary

Foundation for permission-based UI gating: adds the MyOrganization SDK with the GET /user-permissions API, plus the type-safe permission manifest, query keys, types, and pure permission-checking utilities.

This is PR 1 of 3 for the Permission Gating Implementation.
Follow-ups: (2) PermissionProvider context + usePermissions hook, (3) PermissionDeniedTooltip and wiring.

Why

Components currently gate mutations with a coarse binary readOnly prop. The MyOrganization API exposes granular per-resource permissions, so we're moving to fine-grained checks. This approach is a centralized Permission Manifest Provider fetched eagerly at app init. This PR lands the manifest and utilities that everything else builds on.

What

packages/core — new services/my-organization/permissions/ module:

• permission-manifest.ts — PERMISSION_MANIFEST (~29 permissions, grouped by resource) and the derived MyOrgPermission union type.
• permission-query-keys.ts — permissionQueryKeys for React Query cache management (mirrors configQueryKeys).
• permission-types.ts — request/response aliases from the SDK plus the PermissionTier type ('admin' | 'editor' | 'viewer').
• permission-utils.ts:
• hasPermission, hasAnyPermission, hasAllPermissions — type-safe checks over the flat permission list.
• getUserTier(permissions, resource) — derives the behavior tier from the action verbs held for a resource (delete → admin, create/update → editor, else viewer). Resource segments are matched exactly, so sub-resources (e.g. member_roles, memberships) are tiered independently.

Dependency — vendored auth0-myorganization-js@1.1.0 tarball (includes the GET /user-permissions endpoint) and installed it. [To be Removed later once package is released on registry]

Packages

• packages/core
• packages/react
• examples

Testing

Unit tests cover the utilities exhaustively (presence/absence, empty-list vacuous truth, all four tier outcomes, and resource-segment edge cases such as members vs memberships and sub-resource independence). Pure functions and constants only — no runtime/UI behavior in this PR.

• This change adds unit test coverage
• Tested for both SPA and RWA flows, all example apps working
• All existing and new tests complete without errors

Checklist

• Breaking change
• Requires docs update
• Backward compatible

Contributing

• I have read the Auth0 general contribution guidelines
• I have read the Auth0 Code of Conduct

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds MyOrganization permission manifests, query keys, API types, public exports, and React utilities for permission checks and tier calculation. Core now consumes the packaged SDK tarball locally, and the utilities include Vitest coverage.

Changes

MyOrganization permissions

Layer / File(s)	Summary
Permission contracts and exports packages/core/src/services/my-organization/permissions/*, packages/core/src/services/my-organization/index.ts	Defines the permission manifest, derived permission type, query keys, API aliases, permission tiers, and barrel exports.
Permission evaluation utilities packages/react/src/lib/utils/my-organization/permission-utils.ts, packages/react/src/lib/utils/my-organization/__tests__/*	Adds permission presence checks and resource-based tier calculation with Vitest coverage.
Local SDK package wiring auth0-myorganization-js-1.1.0.tgz, packages/core/package.json	Adds the SDK tarball and changes the core dependency to a local file reference.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• auth0/auth0-ui-components#389: Changes overlapping MyOrganization service barrel exports.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and accurately reflects the main permission-manifest, utility, and vendored tarball changes.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/permission-gating-infrastructure

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[grandmaester]

@coderabbitai Review the PR changes

[coderabbitai]

@grandmaester I’ll review the PR changes, including the permission manifest, SDK integration, public exports, and permission utility edge cases.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/core/package.json`:
- Line 55: Update the `@auth0/myorganization-js` dependency in packages/core so
the published package does not reference the repository-relative file: archive;
use the appropriate registry version or ensure packaging rewrites it to a
consumer-available dependency.

In `@packages/react/src/lib/utils/my-organization/permission-utils.ts`:
- Around line 65-73: Update getResourceVerbs to recognize only permissions with
exactly three segments matching <verb>:my_org:<resource>; require the namespace
segment to be my_org and reject trailing segments or other namespaces before
adding the verb.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 43807a54-afdf-4022-9646-d1e292e5f070

📥 Commits

Reviewing files that changed from the base of the PR and between 798a1f6 and d8094de.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (9)

• auth0-myorganization-js-1.1.0.tgz
• packages/core/package.json
• packages/core/src/services/my-organization/index.ts
• packages/core/src/services/my-organization/permissions/index.ts
• packages/core/src/services/my-organization/permissions/permission-manifest.ts
• packages/core/src/services/my-organization/permissions/permission-query-keys.ts
• packages/core/src/services/my-organization/permissions/permission-types.ts
• packages/react/src/lib/utils/my-organization/__tests__/permission-utils.test.ts
• packages/react/src/lib/utils/my-organization/permission-utils.ts

[NaveenChand755]

admin can have all create, update and delete scopes right