zero-fucks-given/docs/core/access-control/backend.md

Access Control Backend

Access Control frontend uses three backend base modules:

apps/backend/app/base_modules/Admin/
apps/backend/app/base_modules/Role/
apps/backend/app/base_modules/Permission/

Routes

Method	Route	Backend	Purpose
GET	/admin	Admin	Paginated admin list.
GET	/admin/:id	Admin	Admin details with roles.
POST	/admin	Admin	Create admin and sync roles.
PUT	/admin/:id	Admin	Update admin and sync roles.
DELETE	/admin/:id	Admin	Delete admin.
PUT	/admin/update-profile	Admin	Update current authenticated admin profile.
GET	/role	Role	Paginated role list.
GET	/role/:id	Role	Role details with permissions.
POST	/role	Role	Create role and role-permission rows.
PUT	/role/:id	Role	Update role and role-permission rows.
DELETE	/role/:id	Role	Delete role.
GET	/permission	Permission	List all available permission definitions.

All routes use middleware.auth() except login routes owned by Auth.

Authorization

Policies:

apps/backend/app/base_modules/Admin/policy/admin_policy.ts
apps/backend/app/base_modules/Role/policy/role_policy.ts
apps/backend/app/base_modules/Permission/policy/permission_policy.ts

Permission slugs are defined in:

apps/backend/app/base_modules/Admin/config/permissions.ts
apps/backend/app/base_modules/Role/config/permissions.ts

Current AccessControl slugs:

admins.view
admins.create
admins.update
admins.delete
role.view
role.create
role.update
role.delete

Permission Loading

Available permissions are collected by:

apps/backend/app/services/permission_service.ts

getAllPermissions() scans app/base_modules/*/config/permissions.ts and app/modules/*/config/permissions.ts. Add permissions to the owning backend module config; do not hard-code them in the frontend.

Validation

Validators:

apps/backend/app/base_modules/Admin/validators/admin_create_validator.ts
apps/backend/app/base_modules/Admin/validators/admin_update_validator.ts
apps/backend/app/base_modules/Admin/validators/admin_update_profile_validator.ts
apps/backend/app/base_modules/Role/validator/role_create_validator.ts
apps/backend/app/base_modules/Role/validator/role_update_validator.ts

Keep frontend form rules compatible with backend validators. Backend validation is authoritative.

Data Notes

• Admin create/update syncs assigned roles through the admin-role relation.
• Role create/update rewrites role_permissions rows for the role.
• Permission records returned by /permission are loaded from permission config files, not only database rows.
• Deleting the final admin is blocked by the Admin controller.