LS5012: Role Allows an Undeclared Permission

LS5012 is a compiler check that reports a role record allowing a permission no permission record declares, because the generator writes each role's allowed permissions from the shared permission list. This page states what the rule reports, where the error sits, and how to declare the permission or remove it from the role.

Reference#

What the Rule Enforces#

LS5012 enforces Generate the Registry, Permissions, and Roles from the Records (litespec/backend/dotnet/stack#generate-the-registry-permissions-and-roles-from-the-records). It runs on Domain, Application, Infrastructure, and WebApi files, where the generator writes role entries. Its category is LiteSpec.Traceability.

What the Rule Reports#

The generator reads each role's allows list against the permission records, so every allowed permission is one the shared list defines. A role allowing a permission no record declares is still emitted, and the rule reports it, naming the role and the permission. The diagnostic has no source location, because the unknown permission lives in the records.

Failing Example#

The role/finance record allows permission/mint-money, which no permission record declares, so the entry carries it and the rule reports.

Passing Example#

The role/finance record allows permission/reimburse-expense, which the permission list declares, so the entry carries it and the rule stays silent.

How to Fix#

Declare the permission in the shared permission list, or remove it from the role's allows list, so every allowed permission is one the list defines.

Notes#

What the Rule Ignores#

The rule does not run in test projects, where no role entries are generated. It stays silent when no .litespec/project.json is in reach, or when the docs root it names cannot be resolved; the CLI owns that configuration error.

Severity#

The rule is an error whenever it fires, because the role allows a permission the shared list does not define. An .editorconfig entry for the rule id overrides it.