Access Grants, Function Events, and Secrets Shown Once

This release is about who can do what. Organization admins can grant only the access they hold, data access rules now apply to the platform's own data, many endpoints check a specific permission, and secrets are shown once and never again. Functions gain event triggers and live streaming, and the workflow editor adds Switch, Merge and Split Out nodes.

Identity

• Admins grant only what they hold (AccessGrant): Previously, anyone with the IAM endpoint permissions could hand out roles and permissions above their own level. Now a caller acting in a non-default organization can assign only roles whose permissions they all hold, grant only permissions they hold, and manage only users whose access is within their own. This covers user access changes, bulk role changes, user activation and deactivation, signup links, role create, update and delete, and client credentials. A refusal returns 403 Access_Grant_Not_Allowed. Single-organization projects, the default organization and the OS console are not affected.

• See what you can grant: GET iam/grant-scope returns the caller's held, managed and assignable roles and held permissions, and GET roles/assignable lists only roles the caller may assign. In the OS console, role and permission pickers show only what you can grant, locked items say "You can grant only permissions you hold.", and users you can't manage are read-only with "You can't manage this user." Roles get a Managed by field.

• Removing access signs the user out: Removing a role or permission from a user, directly, in bulk or by deleting the role, ends that user's sessions. Deactivating a user also ends their sessions, and a deactivated account can no longer refresh its token.

• Client credentials act with their own power: A client credential in a non-default organization can do only what its own client record holds. Before, it acted as the system user.

• Secrets are shown once: List and get responses for client credentials, OIDC clients and identity providers no longer include clientSecret, and identity providers also leave out privateKey. After you create a client, the console shows the secret once with copy buttons. Client credentials get a Rotate Secret action. When you edit an identity provider, leave the secret empty to keep the current one.

• Token lifetimes per OIDC client: An OIDC client can set its own access-token, idle refresh and maximum refresh lifetimes in minutes (access 1 to 1440, refresh 1 to 525600). In the console, choose Custom for this client under Token lifetimes, or Use project settings. Use this for long-running clients such as automation runners.

• Mobile app OIDC clients: The OIDC client dialog has an Application type choice. Mobile app keeps PKCE on and checks redirect URIs against the app-scheme rule. Saving in the console no longer resets a client created through the CLI or API.

• "Sign out of this device" works: Previously, revoking a session could leave the device signed in. Now its refresh tokens and single sign-on session end too. OIDC sign-ins record the browser's device and IP address.

• Access attributes: User details has an Access attributes section for name and value pairs. Data access rules can use Auth.Attributes.<name>, for example DepartmentId IN Auth.Attributes.departmentIds.

• Built-in notifications: IAM notifies users about a new sign-in, a password or MFA change, role changes, activation or deactivation, a revoked session, client credential changes, a finished bulk role change and a finished organization setup.

• Simpler sign-up: The hosted sign-up page shows one unticked Create a new organization box. Leave it unticked to join the project's organization.

• Real client IP behind gateways: ForwardedHeaders:KnownNetworks (CIDR ranges) and ForwardedHeaders:ForwardLimit (default 1) let IAM record the real client address for sessions and audits.

• Fixes: Hosted-OIDC users are no longer signed out after switch-org or /auth/refresh. Reusing a refresh token revokes its whole chain. A password-reset code works only once, and a new password clears lockout.

Data

• Rules apply to the platform's own data: Previously, View column rules on system schemas could be set but were never applied, so GET /api/Mail/GetTemplate still returned TemplateBody. Now OS, Identity, Logic, Deployment and Observability API reads hide excluded columns, and saving what you read keeps the hidden values.

• Create and Edit column rules check each record: A rule that reads a record field, such as CreatedBy == {{Auth.UserId}}, is now checked against the record as stored. If a rule refuses any field, nothing is written, and the error names the field: "You don't have permission to set/change on this record."

• Creators get access to their own records: On insert, the requester's user id is added to the record's Read, Update and Delete user lists. Ids you send are kept.

• Access lists can be queried: Every GraphQL entity type has read-only Create, Read, Update and Delete fields, each with Roles, UserIds and Permissions.

• Records stay in the caller's organization: For callers outside the default organization, a blank OrganizationId is filled with the caller's organization, and any other value is refused.

• Policy rules are checked when saved: A policy that names an Auth value the runtime can't resolve is refused with the list of valid names: UserId, Email, Roles, Permissions, OrganizationId, TenantId.

• Editors: Rule values match the property type, with dropdowns for booleans and enums and a UTC picker for dates. Default values and validations use one box with an { } Expression menu, and validations suggest their own failure message. Nested properties open as a tree.

• Data Access page: A Bulk rules button sets the same validation or default value on several properties across schemas. Backend-only schemas and properties are hidden.

• Live and draft after a rollback: The publish control shows "N unpublished · live vN", and schemas show Not live or Unpublished changes.

• Built-in notifications: Users are notified when a schema version goes live, a data access policy changes, a bulk operation finishes, or an item is shared with them.

• Fixes: Projects with no entity schemas no longer get a 500 on every /gateway request. Data-triggered workflows that use Blocks Authentication run again. Large list queries mask rows about five times faster.

OS

• Trace story: The trace page shows one 2D story with a sentence per step, a line saying where the trace broke, and the logs beside the selected step. Use Open to go into a called service and Back to return.

• New projects come complete: A new project gets the system schemas, built-in notification configurations, MFA config and storage configs. Previously, every notification in a new project failed with "configuration not found".

• Storage secrets: Storage configurations keep their secrets in the SecretStore. Storage/Get and Storage/Gets return a status for each secret (<field>Status), never the value.

• People and environments: People has a Remove access action, and Resend Activation uses the Blocks OS invitation email. An environment card opens only once setup is confirmed, and the owner gets Repair while it is pending. The sidebar layout is saved per user.

• Fixes: A repository added during environment setup keeps its host, and a re-added environment no longer gets the repository twice.

Workflow

• Event triggers for functions: A function can listen to up to 20 event names. When another function emits a FunctionEvent, every live function listening for it runs with the event data, at most 10 per event and 5 levels deep. Event runs wait in their own queue so HTTP calls go first, and a run that waits more than 300 seconds ends as EVENT_EXPIRED.

• Send mail and events after a run: Function code can call ctx.events.add(type, payload) to queue a SendMail or FunctionEvent, up to 50 events and 512 KB per run. They are sent only if the run succeeds. The Events tab chooses which event types a function may send.

• Live Test runs and streaming: The Test panel shows a streamed answer as it arrives. Callers can receive results as Server-Sent Events, either with the new Stream events (SSE) response option or by calling a Wait for answer function with Accept: text/event-stream.

• Automatic trace header: A function's fetch to a Blocks domain carries the run's traceparent, so the call shows in the same trace.

• Export and import: Proxies can be exported. Function and proxy imports show a diff per field and a checklist of the secrets you need to supply.

• New workflow nodes: Switch sends each item to the first rule it matches, with an optional fallback. Merge combines 2 to 10 inputs. Split Out turns a list field into separate items.

• Outbound guard: HTTP Request and Data nodes must call a public http(s) address. Private, loopback and metadata addresses are refused, a call follows at most 5 redirects, and a response over 10 MB fails the item.

• Scheduler: Previously, every worker replica fired every schedule. Now each schedule fires once. The Weekdays 9 AM and Weekly Mon presets save again.

• Fixes: Client Credential auth on Data Action and HTTP Request nodes works again. A page reload no longer overwrites unsaved editor changes. Root users working in a project receive notifications again.

Deployment

• Built-in notifications: Deployment notifies you when a build or code analysis finishes, an auto-deploy status changes, a Data Gateway instance finishes, a repository secret changes, or a domain or teardown fails.

• Notifications reconnect: The notification connection reconnects after your login expires.

• Fix: Switching a repository between Manual and Auto deploy no longer reports failure when GitHub accepted it.

Observability

• More monitors: Each project can have up to 30 monitors, up from 10.

• Accurate uptime: "Currently up for" counts from the last recovery, uptime covers only the time since the monitor was created, and the details page refreshes every 10 seconds.

Localization

• Glossary rules: Each glossary entry has a Rule: Translate with an approved translation per language, Keep for terms such as brand names, or Forbidden. Scope is the whole project or specific modules.

• Custom languages: The New Language dialog accepts a custom name and code, such as gsw-CH.

• Fixes: Imports fill the Module column and refresh the language table, and environment migration reports its real result.

Utilities

• The permission and role forms no longer offer the Data protection resource type.

Developer SDKs

• genesis-net 4.4.2 to 4.4.6 (23 to 25 October): The data access policy engine moved into Genesis, so every service applies Data Gateway policies. Policy denials return 403 FORBIDDEN. Column rules refuse a write instead of dropping the field. Policies can use Attributes.<name>. Server errors return a fixed message instead of exception text. Cached tenants reload after 5 minutes.

• genesis-react 4.4.1 to 4.4.3: After login, only same-origin forwardedTo addresses are followed, and the notification hub reconnects after the login expires.

CLI and SDK

@seliseblocks/cli-os 0.10.0 and 0.11.0, and @seliseblocks/client 0.3.0. New apps from CLI 0.11.0 pin client ^0.3.0.

Functions and proxies from the terminal (CLI 0.11.0)

• blocks logic function: Twenty commands cover the whole function lifecycle without the Studio editor. create starts from a starter template, export <id> --dir writes index.js, package.json and a function.json of settings, and save <id> --dir sends them back. save reads the stored function first, so only what you supply changes. test runs the saved code without deploying. deploy ships it, and when the image is still building it waits for that build and deploys exactly that one. url prints the public invoke URL with the x-blocks-key, methods and auth a caller needs. runs, run, logs, replay, cancel, versions, source, build, audit and limits cover debugging and history.

• Proxy limits: logic proxy create|update take --requests-per-minute and --timeout-seconds. logic proxy openapi-preview lists the routes an OpenAPI 3 document would add, and flags ones a proxy already has.

• blocks pull also writes blocks/logic/functions.json.

A folder per service (CLI 0.10.0)

• Same blocks/ tree everywhere: blocks init and blocks new web now write the same tree, with iam/, auth/, mail/, storage/, release/ and logic/ folders next to data/, localization/ and workflows/. Each folder has a README saying what belongs there and which commands change it.

• blocks pull: writes a read-only snapshot of the project's setup into those folders: roles and permissions, auth config, OIDC clients and identity providers, mail and storage configs, release repos, proxies and schedules. Agents read the setup from files instead of making a dozen list calls. Secrets are redacted to *** unless you pass --include-secrets, and each file carries the tenant and time it was pulled.

SDK (client 0.3.0)

• blocks.logic.functions: call(id, options) invokes a deployed function and returns its value, whether it answers right away or runs as a queued job, and throws BlocksFunctionRunError when the run fails. invoke, getResult, waitForResult and invokeRaw give lower-level control.

• blocks.logic.proxy: request(slug, options) calls a configured proxy's gateway route.

• @seliseblocks/client/functions: type declarations for a function's handler, input and context, for editor checking of a function's index.js.

• Clearer errors: a BlocksApiError message now includes the field that failed validation, instead of only "One or more validation errors occurred."

Fixed

• Proxy updates keep their settings: logic proxy update --name no longer removes the proxy's retry policy and rate limit, and an update made from a stale copy is refused with PROXY_VERSION_CONFLICT instead of overwriting someone else's change.

• Lists start at the first page: iam organizations list and notification list skipped their first page of results. organizations list filters work without --search, and iam users list --organization-id returns only that organization's members.

• iam users activate requires --reason, which IAM always required. The command now says so before sending.

• iam email available answers for the selected project instead of for all platform accounts.

• Enabling OIDC points activation and password-reset links at the IAM host instead of the project's app domain, which serves nothing until an app is deployed. auth config save warns when the activation page does not answer.

• Permission errors name the permission: iam email available and notifier notify report permission_required with the permission your role needs, instead of suggesting blocks login.

• storage config list|get show each secret's status, never its value.

Upgrade notes

iam/email/available was public, so a signup form can no longer call it before the user signs in.