SRV-06 — RBAC & data scopes

SummaryCopy Anchor Link

Role and permission catalogue (module × action), permission guard on every procedure, delegate zone scope and reseller ownership scope as reusable query filters.

DescriptionCopy Anchor Link

The cahier (§3, §3.1) asks for eight roles, permissions per module and action, and strict data scopes; ACL-05 requires every API operation to enforce them server-side. This task implements the permission catalogue (<module>.<action> over the 18 modules and 7 actions), the default matrix for the 8 roles, an oRPC middleware that checks the permission declared on each procedure, and two reusable scope filters: self (a reseller's own data) and delegate (the delegate's zones and assigned resellers) applied as Prisma where builders, returning 404 NOT_FOUND/403 OUT_OF_SCOPE outside scope. Financial fields (purchase price, margins, credit) are stripped from responses unless the caller holds the right permission (ACL-04). It also implements admin.roles.list, admin.roles.updatePermissions and admin.permissions.list with PERMISSION_CHANGE audit. Out of scope: the matrix UI (DSH-12).

SubtasksCopy Anchor Link

DeliverablesCopy Anchor Link

• apps/server/src/modules/access/{catalogue.ts,matrix.seed.ts,guard.ts,scopes.ts,roles.router.ts}
• packages/contracts/src/admin/system.roles.ts
• Permissions matrix page /docs/srs/permissions-matrix aligned with the seed

Acceptance criteriaCopy Anchor Link

• A STOCK_MANAGER calling admin.orders.validate gets 403 PERMISSION_DENIED (ACL-02, ACL-05)
• A delegate requesting a reseller outside their zones and assignments gets 403 OUT_OF_SCOPE; a reseller requesting another reseller's order gets 404 NOT_FOUND (ACL-03)
• purchasePrice is absent from admin.products.get for a user without pricing.administer (ACL-04)
• Changing a role's permissions takes effect on the next request of its users and writes a PERMISSION_CHANGE audit entry
• The CI guard fails when a procedure has no permission or scope declaration

Requirements coveredCopy Anchor Link

API surfaceCopy Anchor Link

Test measuresCopy Anchor Link

• Table-driven permission test: for each role × sample procedure, expected allow/deny
• DB tests for scope filters with delegates on overlapping zones
• Unit test of response shaping for restricted fields

RisksCopy Anchor Link

• Scope checks forgotten on list endpoints — scopes are applied in the repository layer by default and must be explicitly bypassed for staff

KPICopy Anchor Link

• Delivered by Mon 19 Oct 2026 within 1 person-day(s).
• Every acceptance criterion above demonstrated before hand-off; linked requirements' acceptance criteria pass.
• Zero open critical defects, permission gaps or data-integrity regressions at sign-off.

---

Generated from content/plan/tasks.json by scripts/generate-team-tasks.mjs. Dates are computed by the scheduler (Sunday–Thursday weeks, holidays excluded) — change the plan, not this page.