---
description: Business-scoped RBAC and permission patterns
globs: src/**/*.controller.ts,src/**/*.service.ts
alwaysApply: false
---

# Business RBAC

## Permission slugs

Format: `resource.action` — e.g. `products.read`, `categories.update`, `business.team.invite`

Content resources: `products.*`, `categories.*`, `media.*`, `business.team.*`

## Who gets access

- `super_admin` → all permissions (bypasses business guard)
- Business owner (`isOwner=true`) → `business_owner` role permissions
- Team member → permissions from `business_users.role_id` (admin/editor/viewer)
- Team **admin** may invite/update/remove **non-admin** staff only (cannot change or assign other admins)
- Team **editor** / **viewer** have no `business.team.*` manage permissions
- Only **super_admin** may assign or change the `admin` team role (owners/admins may assign editor/viewer)
- Owners cannot be changed via team APIs; use `PATCH .../team/access` for customer vs manager (staff)

## Adding a business-scoped endpoint

1. Route: `businesses/:businessId/<resource>`
2. `@UseGuards(JwtAuthGuard, BusinessPermissionGuard)`
3. `@RequireBusinessPermission('resource.action')` on handler
4. `assertPermission()` again inside the service

## Platform-only endpoints

Super-admin routes (`/users`, `/businesses`, `/domains`) check `permissions.isSuperAdmin()` in the service — no `BusinessPermissionGuard`.

## New permissions

Add `INSERT INTO permissions` + `role_permissions` in a SQL migration, then assign to relevant team roles.