mirror of
https://git.meshkee.com/Meshkee/backend.git
synced 2026-08-11 22:30:59 +04:30
Ali Reza
bb59d5e9ba
NestJS backend with Prisma, Docker Compose for Postgres/Redis, and deploy docs for the production VM.
35 lines
1.1 KiB
Plaintext
35 lines
1.1 KiB
Plaintext
---
|
|
description: Business-scoped RBAC and permission patterns
|
|
globs: src/**/*.controller.ts,src/**/*.service.ts
|
|
alwaysApply: false
|
|
---
|
|
|
|
# Business RBAC
|
|
|
|
## Permission slugs
|
|
|
|
Format: `resource.action` — e.g. `products.read`, `categories.update`, `business.team.invite`
|
|
|
|
Content resources: `products.*`, `categories.*`, `media.*`, `business.team.*`
|
|
|
|
## Who gets access
|
|
|
|
- `super_admin` → all permissions (bypasses business guard)
|
|
- Business owner (`isOwner=true`) → `business_owner` role permissions
|
|
- Team member → permissions from `business_users.role_id` (admin/editor/viewer)
|
|
|
|
## Adding a business-scoped endpoint
|
|
|
|
1. Route: `businesses/:businessId/<resource>`
|
|
2. `@UseGuards(JwtAuthGuard, BusinessPermissionGuard)`
|
|
3. `@RequireBusinessPermission('resource.action')` on handler
|
|
4. `assertPermission()` again inside the service
|
|
|
|
## Platform-only endpoints
|
|
|
|
Super-admin routes (`/users`, `/businesses`, `/domains`) check `permissions.isSuperAdmin()` in the service — no `BusinessPermissionGuard`.
|
|
|
|
## New permissions
|
|
|
|
Add `INSERT INTO permissions` + `role_permissions` in a SQL migration, then assign to relevant team roles.
|