Skip to content

Update Users & Permissions documentation#3169

Merged
pwizla merged 45 commits into
mainfrom
cms/update-users-permissions-docs
Jun 2, 2026
Merged

Update Users & Permissions documentation#3169
pwizla merged 45 commits into
mainfrom
cms/update-users-permissions-docs

Conversation

@pwizla

@pwizla pwizla commented May 12, 2026

Copy link
Copy Markdown
Collaborator

This PR updates the Users & Permissions documentation based on a full source code audit (v5.45.1).

  • Fix incorrect default values (token lifespans, rate limiting, JWT secret location)
  • Split API usage into dedicated REST API and GraphQL API sub-pages
  • Document all auth, user CRUD, roles, and permissions endpoints with examples
  • Document all 13 GraphQL operations (previously undocumented)
  • Fix provider pages: copy-paste errors, deprecation warnings for Instagram/LinkedIn/Twitter
  • Fix authentication example: wrong defaults, broken code block
  • Fix customization guide: strapi scoping bug in code examples
  • Add actionable content to register-allowed-fields breaking change

Direct preview link 👉 here

pwizla and others added 7 commits May 12, 2026 12:13
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…ng change

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@vercel

vercel Bot commented May 12, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
documentation Ready Ready Preview, Comment Jun 2, 2026 4:47pm

Request Review

@github-actions github-actions Bot added pr: new content PRs for new product features or new documentation sections source: repo PRs/issues not targeting a specific documentation but rather affecting the whole repo labels May 12, 2026
@github-actions github-actions Bot added the internal PRs created by the Strapi core team label May 12, 2026
@pwizla pwizla changed the title Update Users & Permissions documentation from full audit Update Users & Permissions documentation May 12, 2026
@pwizla pwizla self-assigned this May 12, 2026
@pwizla pwizla added the flag: don't merge This PR should not be merged at the moment label May 12, 2026
…on, unique username on provider conflict

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…esh response

- Revert (plugin, { strapi }) to (plugin) in extension examples (runtime TypeError)
- Add refreshToken to refresh endpoint response, document httpOnly variant
- Fix role deletion claim: users are reassigned, no precondition check
- Fix username generation: random number, not incrementing
- Fix "setup" to "set up" (verb) in CAS provider page
- Fix "urls" to "URLs" in Auth0 provider page
- Add missing commas in security configuration section
- Use numerals per style guide ("All 3 fields" not "All three")
- Tighten sentence in register-allowed-fields breaking change

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@pwizla pwizla added pr: updated content PRs updating existing documentation content and removed flag: don't merge This PR should not be merged at the moment pr: new content PRs for new product features or new documentation sections labels Jun 2, 2026
pwizla added a commit that referenced this pull request Jun 2, 2026
pwizla added 2 commits June 2, 2026 17:35
Empirical testing against Strapi v5 showed that updateUsersPermissionsUser and deleteUsersPermissionsUser accept the numeric database id, not the documentId. Reverse the note and update both example snippets to use id: "1".
Empirically verified against Strapi v5: send-email-confirmation returns "User blocked" (not the login phrasing), reset-password and change-password return "Passwords do not match" on mismatch, and DELETE /api/users-permissions/roles/:id returns "Cannot delete public role" for the Public role.
@pwizla pwizla marked this pull request as ready for review June 2, 2026 16:48

@pwizla pwizla left a comment

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, finally, after numerous fixes and source code verifications + test app checks 🚀

@pwizla pwizla added this to the 6.27.0 milestone Jun 2, 2026
@pwizla pwizla merged commit 84afed6 into main Jun 2, 2026
4 checks passed
@pwizla pwizla deleted the cms/update-users-permissions-docs branch June 2, 2026 16:49
pwizla added a commit that referenced this pull request Jun 4, 2026
… Docs update (#3200)

* Scaffold inki plugin: plugin.json + README stub

* Add self-hosted marketplace manifest exposing inki

* Add /inki:exists pilot skill (port of PAWS doc-exists)

* Copy shared rules into inki plugin to remove PAWS path dependency

* Add /inki:branch (port of PAWS doc-branch)

* Add /inki:commit (port of PAWS doc-commit)

* Add /inki:push (port of PAWS doc-push)

* Add /inki:pr (port of PAWS doc-pr)

* Add /inki:pr-title-fix (port of PAWS doc-pr-title-fix)

* Add /inki:pr-description-fix (port of PAWS doc-pr-description-fix)

* Add /inki:pr-body-fix alias

* Rewrite PAWS slash command references to inki namespace in ported skills

* Add /inki:submit top-level orchestrator

* Move agents/prompts/ into inki/references/prompts/

* Move agents/templates/ into inki/references/templates/

* Move agents/authoring/ into inki/references/authoring/

* Replace agents/ content with pointer README to inki/references/

* Initial sync: copy root canonical refs into inki/references/

* Add /inki:style-check skill

* Add /inki:code-verify skill

* Add /inki:coherence-check skill

* Add /inki:pitfalls-check skill

* Add /inki:outline-check skill

* Add /inki:outline-ux-analyzer skill

* Add /inki:review top-level orchestrator

* Add /inki:outline skill

* Add /inki:draft skill

* Add /inki:write top-level orchestrator

* Add /inki:route skill

* Add /inki:coverage skill

* Add /inki:discover top-level orchestrator

* Add sync-root-refs.sh script for root → plugin refs

* Add inki-sync-root-refs.yml: 1-way sync + drift guard

* Expand inki README with full skill catalog and editing rules

* Add inki CHANGELOG.md v0.1.0

* Document Inki plugin and editing rules in CONTRIBUTING.md

* Update AGENTS.md to point to claude-plugins/inki/references/ instead of agents/

* Update Cursor rules to reference claude-plugins/inki/references/ paths

* Update self-healing prompts to reference claude-plugins/inki/references/ paths

* Remove low profile PR guideline from git rules

Removed guideline about not opening PRs when asked to stay low profile.

* Remove PAWS-internal Tier mentions and replace 'Pierre' with 'the user' in plugin skills

* Sync inki/references/git-rules.md with root after low-profile guideline removal

* Clarify pr-description-rules: separate Fixes and Documents references for strapi/strapi PRs

* Scope shared rules to strapi/documentation and remove PAWS-internal references

* Prepend 'Do not' to each item in push-rules.md 'Do not' section

* Prepend 'Do not' to each item in pr-rules.md 'Do not' section

* Make inki skills portable: remove hardcoded paths and /piwi-* references

* Expand CONTRIBUTING Inki section with what-it-does summary and README link

* Clarify 'Do not open PR from main': specify source vs target branch

* Remove restrictive working dir check from git skills: support forks

* Document Strapi codebase prerequisite in code-verify and coverage skills

* Remove references to strapi-docs-product-merger (private repo) from plugin

* Rewrite orphan agents/ paths in migrated prompts and authoring guides to inki/references/

* Drop legacy agents/ path references from CHANGELOG

* Clarify pitfalls-check: known-pitfalls file is a reference catalog, not a prompt

* Read git-rules.md from inki/references/ instead of repo root for plugin autonomy

* Migrate style-lint.sh into the inki plugin and wire style-check to use it

* Add notation legend in README to explain skill argument placeholders

* Fix marketplace.json schema: wrap plugins in marketplace object

* Fix marketplace.json plugin source: use relative path string instead of local source object

* Remove stray closing tag from marketplace.json

* Fix plugin.json author field: expect object schema, not string

* Add URL parsing and --yes auto-mode to pr-title-fix and pr-description-fix

* Add safety bracket to --yes mode: batch review when no PR IDs are listed

* Apply priorities 1-3: URL parsing in route, --yes in review/submit/write, --include-old default skip in pr-*-fix

* Switch PR recency filter from updatedAt to createdAt to avoid bot-bumped PRs

* Improve inki: accept PR URL in review, add pr-worktree helper, extend style-lint acronyms

* Refactor: merge pr-title-fix, pr-description-fix, pr-body-fix into one pr-fix skill with action argument

* Make pr-fix description add the Vercel preview link if missing, not just preserve it

* Mirror PR #3169 changes to inki/references/ for agents/ files migrated by Inki

* Accept more target types in the inki review skill (#3215)

* Accept docs.strapi.io URLs, filenames, and pasted content as review targets

* Document flexible review targets in README and CHANGELOG

* Resolve docs.strapi.io review targets against origin/main

A docs.strapi.io URL points at the published page, so the review now reads the source from origin/main (via git fetch + git show, never a destructive pull) and warns when local uncommitted changes to that file are excluded.

* Document origin/main URL resolution in inki CHANGELOG

* Review docs.strapi.io URLs in an origin/main worktree

Resolve a docs.strapi.io URL into a temporary detached worktree on origin/main (new main-worktree.sh helper) instead of a loose /tmp file, so the source sits at its real path under docusaurus/docs/ and coherence-check and code-verify keep resolving relative links and sibling pages.

* Fix pr-fix Vercel link: read host from bot comment, slug as fallback

* Document the developer refresh cycle in the inki README

* Sync inki CHANGELOG with work through 2026-06-03

* Rename inki Discover family to Research to align with writer workflow

* Update marketplace.json slogan after Discover→Research rename

* Rewrite Inki plugin README with problem framing and flagship skill walkthroughs

* Use placeholder PR number in Inki README review example

* Present Inki families as an end-to-end docs workflow with usage guidance

* Fix typo in Inki README description
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

internal PRs created by the Strapi core team pr: updated content PRs updating existing documentation content source: repo PRs/issues not targeting a specific documentation but rather affecting the whole repo

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant