90 lines
3.3 KiB
Markdown
90 lines
3.3 KiB
Markdown
# Access Control Backend
|
|
|
|
Access Control frontend uses three backend base modules:
|
|
|
|
```txt
|
|
apps/backend/app/base_modules/Admin/
|
|
apps/backend/app/base_modules/Role/
|
|
apps/backend/app/base_modules/Permission/
|
|
```
|
|
|
|
## Routes
|
|
|
|
| Method | Route | Backend | Purpose |
|
|
| -------- | ----------------------- | ---------- | ------------------------------------------- |
|
|
| `GET` | `/admin` | Admin | Paginated admin list. |
|
|
| `GET` | `/admin/:id` | Admin | Admin details with roles. |
|
|
| `POST` | `/admin` | Admin | Create admin and sync roles. |
|
|
| `PUT` | `/admin/:id` | Admin | Update admin and sync roles. |
|
|
| `DELETE` | `/admin/:id` | Admin | Delete admin. |
|
|
| `PUT` | `/admin/update-profile` | Admin | Update current authenticated admin profile. |
|
|
| `GET` | `/role` | Role | Paginated role list. |
|
|
| `GET` | `/role/:id` | Role | Role details with permissions. |
|
|
| `POST` | `/role` | Role | Create role and role-permission rows. |
|
|
| `PUT` | `/role/:id` | Role | Update role and role-permission rows. |
|
|
| `DELETE` | `/role/:id` | Role | Delete role. |
|
|
| `GET` | `/permission` | Permission | List all available permission definitions. |
|
|
|
|
All routes use `middleware.auth()` except login routes owned by Auth.
|
|
|
|
## Authorization
|
|
|
|
Policies:
|
|
|
|
```txt
|
|
apps/backend/app/base_modules/Admin/policy/admin_policy.ts
|
|
apps/backend/app/base_modules/Role/policy/role_policy.ts
|
|
apps/backend/app/base_modules/Permission/policy/permission_policy.ts
|
|
```
|
|
|
|
Permission slugs are defined in:
|
|
|
|
```txt
|
|
apps/backend/app/base_modules/Admin/config/permissions.ts
|
|
apps/backend/app/base_modules/Role/config/permissions.ts
|
|
```
|
|
|
|
Current AccessControl slugs:
|
|
|
|
```txt
|
|
admins.view
|
|
admins.create
|
|
admins.update
|
|
admins.delete
|
|
role.view
|
|
role.create
|
|
role.update
|
|
role.delete
|
|
```
|
|
|
|
## Permission Loading
|
|
|
|
Available permissions are collected by:
|
|
|
|
```txt
|
|
apps/backend/app/services/permission_service.ts
|
|
```
|
|
|
|
`getAllPermissions()` scans `app/base_modules/*/config/permissions.ts` and `app/modules/*/config/permissions.ts`. Add permissions to the owning backend module config; do not hard-code them in the frontend.
|
|
|
|
## Validation
|
|
|
|
Validators:
|
|
|
|
```txt
|
|
apps/backend/app/base_modules/Admin/validators/admin_create_validator.ts
|
|
apps/backend/app/base_modules/Admin/validators/admin_update_validator.ts
|
|
apps/backend/app/base_modules/Admin/validators/admin_update_profile_validator.ts
|
|
apps/backend/app/base_modules/Role/validator/role_create_validator.ts
|
|
apps/backend/app/base_modules/Role/validator/role_update_validator.ts
|
|
```
|
|
|
|
Keep frontend form rules compatible with backend validators. Backend validation is authoritative.
|
|
|
|
## Data Notes
|
|
|
|
- Admin create/update syncs assigned roles through the admin-role relation.
|
|
- Role create/update rewrites `role_permissions` rows for the role.
|
|
- Permission records returned by `/permission` are loaded from permission config files, not only database rows.
|
|
- Deleting the final admin is blocked by the Admin controller.
|