mirror of
https://git.meshkee.com/Meshkee/backend.git
synced 2026-08-11 22:30:59 +04:30
Alireza HassaniandCursor
e59db25814
Super-admins can assign Admin; owners/admins manage Editor/Viewer via team/access, and the customers list supports all/customers/managers filtering. Co-authored-by: Cursor <cursoragent@cursor.com>
39 lines
1.5 KiB
Plaintext
39 lines
1.5 KiB
Plaintext
---
|
|
description: Business-scoped RBAC and permission patterns
|
|
globs: src/**/*.controller.ts,src/**/*.service.ts
|
|
alwaysApply: false
|
|
---
|
|
|
|
# Business RBAC
|
|
|
|
## Permission slugs
|
|
|
|
Format: `resource.action` — e.g. `products.read`, `categories.update`, `business.team.invite`
|
|
|
|
Content resources: `products.*`, `categories.*`, `media.*`, `business.team.*`
|
|
|
|
## Who gets access
|
|
|
|
- `super_admin` → all permissions (bypasses business guard)
|
|
- Business owner (`isOwner=true`) → `business_owner` role permissions
|
|
- Team member → permissions from `business_users.role_id` (admin/editor/viewer)
|
|
- Team **admin** may invite/update/remove **non-admin** staff only (cannot change or assign other admins)
|
|
- Team **editor** / **viewer** have no `business.team.*` manage permissions
|
|
- Only **super_admin** may assign or change the `admin` team role (owners/admins may assign editor/viewer)
|
|
- Owners cannot be changed via team APIs; use `PATCH .../team/access` for customer vs manager (staff)
|
|
|
|
## Adding a business-scoped endpoint
|
|
|
|
1. Route: `businesses/:businessId/<resource>`
|
|
2. `@UseGuards(JwtAuthGuard, BusinessPermissionGuard)`
|
|
3. `@RequireBusinessPermission('resource.action')` on handler
|
|
4. `assertPermission()` again inside the service
|
|
|
|
## Platform-only endpoints
|
|
|
|
Super-admin routes (`/users`, `/businesses`, `/domains`) check `permissions.isSuperAdmin()` in the service — no `BusinessPermissionGuard`.
|
|
|
|
## New permissions
|
|
|
|
Add `INSERT INTO permissions` + `role_permissions` in a SQL migration, then assign to relevant team roles.
|