# Access Control Backend

Access Control frontend uses three backend base modules:

```txt
backend/app/base_modules/Admin/
backend/app/base_modules/Role/
backend/app/base_modules/Permission/
```

## Routes

| Method   | Route                   | Backend    | Purpose                                     |
| -------- | ----------------------- | ---------- | ------------------------------------------- |
| `GET`    | `/admin`                | Admin      | Paginated admin list.                       |
| `GET`    | `/admin/:id`            | Admin      | Admin details with roles.                   |
| `POST`   | `/admin`                | Admin      | Create admin and sync roles.                |
| `PUT`    | `/admin/:id`            | Admin      | Update admin and sync roles.                |
| `DELETE` | `/admin/:id`            | Admin      | Delete admin.                               |
| `PUT`    | `/admin/update-profile` | Admin      | Update current authenticated admin profile. |
| `GET`    | `/role`                 | Role       | Paginated role list.                        |
| `GET`    | `/role/:id`             | Role       | Role details with permissions.              |
| `POST`   | `/role`                 | Role       | Create role and role-permission rows.       |
| `PUT`    | `/role/:id`             | Role       | Update role and role-permission rows.       |
| `DELETE` | `/role/:id`             | Role       | Delete role.                                |
| `GET`    | `/permission`           | Permission | List all available permission definitions.  |

All routes use `middleware.auth()` except login routes owned by Auth.

## Authorization

Policies:

```txt
backend/app/base_modules/Admin/policy/admin_policy.ts
backend/app/base_modules/Role/policy/role_policy.ts
backend/app/base_modules/Permission/policy/permission_policy.ts
```

Permission slugs are defined in:

```txt
backend/app/base_modules/Admin/config/permissions.ts
backend/app/base_modules/Role/config/permissions.ts
```

Current AccessControl slugs:

```txt
admins.view
admins.create
admins.update
admins.delete
role.view
role.create
role.update
role.delete
```

## Permission Loading

Available permissions are collected by:

```txt
backend/app/services/permission_service.ts
```

`getAllPermissions()` scans `app/base_modules/*/config/permissions.ts` and `app/modules/*/config/permissions.ts`. Add permissions to the owning backend module config; do not hard-code them in the frontend.

## Validation

Validators:

```txt
backend/app/base_modules/Admin/validators/admin_create_validator.ts
backend/app/base_modules/Admin/validators/admin_update_validator.ts
backend/app/base_modules/Admin/validators/admin_update_profile_validator.ts
backend/app/base_modules/Role/validator/role_create_validator.ts
backend/app/base_modules/Role/validator/role_update_validator.ts
```

Keep frontend form rules compatible with backend validators. Backend validation is authoritative.

## Data Notes

- Admin create/update syncs assigned roles through the admin-role relation.
- Role create/update rewrites `role_permissions` rows for the role.
- Permission records returned by `/permission` are loaded from permission config files, not only database rows.
- Deleting the final admin is blocked by the Admin controller.