rbacv0.01The RBAC module enforces authorization by resolving permissions and security group memberships for authenticated users.
Authorization decisions are made:
Permissions may be granted:
Revocation is supported via soft-delete semantics (revoked_at IS NULL).
"admin.panel")revoked_at IS NULL/api/rbac/effective-permissionsReceive Request
user_id (UUID)Fetch Direct User Permissions
Query user_permissions
Filters:
user_id = :user_idrevoked_at IS NULLExtract permission strings
Fetch Active Security Group Memberships
Query user_security_groups
Filters:
user_id = :user_idrevoked_at IS NULLCollect group_ids
Fetch Group Permissions
Query security_group_permissions
Filter:
group_id IN (:group_ids)Extract permission strings
Merge Permissions
BTreeSet<String>Return Response
✅ Deterministic, ordered list of permissions
❌ Revoked permissions are excluded automatically
Receive Permission Check
user_id, permissionCheck Direct Permission
Query user_permissions
Filters:
user_idpermissionrevoked_at IS NULLShort-Circuit if Found
Fetch Active Group IDs
Query user_security_groups
Filter:
revoked_at IS NULLCheck Group Permissions
Query security_group_permissions
Filters:
group_id IN (...)permissionReturn Decision
Resolve Group ID
security_groupsname = :group_nameFail Fast if Group Missing
falseCheck Active Membership
Query user_security_groups
Filters:
user_idgroup_idrevoked_at IS NULLReturn Result
truefalseis_in_group_namehas_any_group_name(user, ["admin", "moderator"])
| Scenario | Behavior |
|---|---|
| User has no permissions | Empty permission set |
| All permissions revoked | Deny |
| Group deleted | Treated as non-member |
| Permission revoked | Automatically excluded |
| Duplicate permissions | De-duplicated |