82 lines
2.1 KiB
Markdown
82 lines
2.1 KiB
Markdown
# Permission Backend
|
|
|
|
The backend Permission module exposes available permission definitions. It is used by AccessControl when assigning permissions to roles.
|
|
|
|
Source root:
|
|
|
|
```txt
|
|
apps/backend/app/base_modules/Permission/
|
|
```
|
|
|
|
## Route
|
|
|
|
| Method | Route | Controller Method | Auth Required | Purpose |
|
|
| ------ | ------------- | ----------------- | ------------- | -------------------------------------------- |
|
|
| `GET` | `/permission` | `index` | Yes | Return all available permission definitions. |
|
|
|
|
Route file:
|
|
|
|
```txt
|
|
apps/backend/app/base_modules/Permission/routes.ts
|
|
```
|
|
|
|
## Request Flow
|
|
|
|
```txt
|
|
GET /permission
|
|
-> auth middleware
|
|
-> PermissionController.index
|
|
-> getAllPermissions()
|
|
-> scan backend module permission configs
|
|
-> return PermissionItem[]
|
|
```
|
|
|
|
## Permission Discovery
|
|
|
|
Permission discovery lives in:
|
|
|
|
```txt
|
|
apps/backend/app/services/permission_service.ts
|
|
```
|
|
|
|
`getAllPermissions()` scans:
|
|
|
|
```txt
|
|
apps/backend/app/base_modules/*/config/permissions.ts
|
|
apps/backend/app/modules/*/config/permissions.ts
|
|
```
|
|
|
|
Each config exports permission items:
|
|
|
|
```ts
|
|
type PermissionItem = {
|
|
slug: string;
|
|
name: string;
|
|
};
|
|
```
|
|
|
|
## Current Permission Configs
|
|
|
|
Core permission definitions currently include:
|
|
|
|
```txt
|
|
apps/backend/app/base_modules/Admin/config/permissions.ts
|
|
apps/backend/app/base_modules/Role/config/permissions.ts
|
|
apps/backend/app/base_modules/FileManager/config/permissions.ts
|
|
```
|
|
|
|
When adding a feature that needs access control, add permission definitions to the owning backend module's `config/permissions.ts`.
|
|
|
|
## Admin Permission Slugs
|
|
|
|
`getAdminPermissionSlugs(admin)` loads an admin's roles and returns a set of permission slugs from `role_permissions`.
|
|
|
|
This function is used by backend policies to authorize operations.
|
|
|
|
## Ownership Rules
|
|
|
|
- Backend modules own their own permission definitions.
|
|
- Permission service owns discovering all available permission definitions.
|
|
- AccessControl owns assigning permission slugs to roles.
|
|
- Auth owns returning the current user's permission slugs to the frontend.
|