# Permission Backend

The backend Permission module exposes available permission definitions. It is used by AccessControl when assigning permissions to roles.

Source root:

```txt
apps/backend/app/base_modules/Permission/
```

## Route

| Method | Route         | Controller Method | Auth Required | Purpose                                      |
| ------ | ------------- | ----------------- | ------------- | -------------------------------------------- |
| `GET`  | `/permission` | `index`           | Yes           | Return all available permission definitions. |

Route file:

```txt
apps/backend/app/base_modules/Permission/routes.ts
```

## Request Flow

```txt
GET /permission
  -> auth middleware
  -> PermissionController.index
  -> getAllPermissions()
  -> scan backend module permission configs
  -> return PermissionItem[]
```

## Permission Discovery

Permission discovery lives in:

```txt
apps/backend/app/services/permission_service.ts
```

`getAllPermissions()` scans:

```txt
apps/backend/app/base_modules/*/config/permissions.ts
apps/backend/app/modules/*/config/permissions.ts
```

Each config exports permission items:

```ts
type PermissionItem = {
  slug: string;
  name: string;
};
```

## Current Permission Configs

Core permission definitions currently include:

```txt
apps/backend/app/base_modules/Admin/config/permissions.ts
apps/backend/app/base_modules/Role/config/permissions.ts
apps/backend/app/base_modules/FileManager/config/permissions.ts
```

When adding a feature that needs access control, add permission definitions to the owning backend module's `config/permissions.ts`.

## Admin Permission Slugs

`getAdminPermissionSlugs(admin)` loads an admin's roles and returns a set of permission slugs from `role_permissions`.

This function is used by backend policies to authorize operations.

## Ownership Rules

- Backend modules own their own permission definitions.
- Permission service owns discovering all available permission definitions.
- AccessControl owns assigning permission slugs to roles.
- Auth owns returning the current user's permission slugs to the frontend.