User Management Routing Configuration

Overview

The user management module uses a comprehensive routing system with multi-level security guards to ensure proper authentication and authorization.

Route Structure

/users
├── /list                    # User list view
├── /create                  # Create new user
├── /:id                     # User detail view
├── /:id/edit                # Edit user
└── /admin/manage            # Admin user management

Security Guards

All routes implement a multi-layered security approach:

1. Authentication Layer (authGuard)

• Purpose: Validates JWT token existence and validity
• Applied to: All routes
• Failure Action: Redirects to /login

2. Permission Layer (permissionGuard)

• Purpose: Validates resource:action permissions
• Applied to: All routes
• Failure Action: Redirects to /access-denied, emits authorization.denied event

3. Role Layer (roleGuard)

• Purpose: Additional role-based restrictions
• Applied to: Admin routes only
• Failure Action: Redirects to /access-denied, emits access.denied.role event

Route Details

User List (/users/list)

Guards: authGuard, permissionGuard('users:read')

Purpose: Display paginated user list with filtering

Permissions Required:

• users:read

Data:

{
  title: 'User List',
  breadcrumb: 'Users',
  permissions: ['users:read']
}

Component: UserListComponent (lazy-loaded)

Create User (/users/create)

Guards: authGuard, permissionGuard('users:create')

Purpose: Create new user form

Permissions Required:

• users:create

Data:

{
  title: 'Create User',
  breadcrumb: 'Create',
  permissions: ['users:create'],
  mode: 'create'
}

Component: UserFormComponent (lazy-loaded)

User Detail (/users/:id)

Guards: authGuard, permissionGuard('users:read')

Purpose: Display detailed user information

Permissions Required:

• users:read

Parameters:

• id: User ID (UUID)

Data:

{
  title: 'User Details',
  breadcrumb: 'Details',
  permissions: ['users:read']
}

Component: UserDetailComponent (lazy-loaded)

Edit User (/users/:id/edit)

Guards: authGuard, permissionGuard('users:update')

Purpose: Edit existing user form

Permissions Required:

• users:update

Parameters:

• id: User ID (UUID)

Data:

{
  title: 'Edit User',
  breadcrumb: 'Edit',
  permissions: ['users:update'],
  mode: 'edit'
}

Component: UserFormComponent (lazy-loaded)

Admin User Management (/users/admin/manage)

Guards: authGuard, roleGuard(SystemRoles.ADMIN), permissionGuard('users:manage')

Purpose: Advanced user management for administrators

Permissions Required:

• users:manage

Roles Required:

• SystemRoles.ADMIN

Data:

{
  title: 'User Management (Admin)',
  breadcrumb: 'Manage Users',
  permissions: ['users:manage'],
  roles: [SystemRoles.ADMIN],
  adminOnly: true
}

Component: UserListComponent (lazy-loaded with admin features)

Permission Matrix

Route Helper Functions

The module exports utility functions for programmatic navigation:

import {
  getUserListRoute,
  getUserDetailRoute,
  getUserEditRoute,
  getUserCreateRoute,
  getAdminUserManagementRoute
} from '@libs-core/user-management';

// Navigate to user list
router.navigate([getUserListRoute()]);
// Result: /users/list

// Navigate to user detail
router.navigate([getUserDetailRoute('user-123')]);
// Result: /users/user-123

// Navigate to edit user
router.navigate([getUserEditRoute('user-123')]);
// Result: /users/user-123/edit

// Navigate to create user
router.navigate([getUserCreateRoute()]);
// Result: /users/create

// Navigate to admin management
router.navigate([getAdminUserManagementRoute()]);
// Result: /users/admin/manage

Integration Example

Main Application Routes

// app.routes.ts
import { Routes } from '@angular/router';
import { userManagementRoutes } from '@libs-core/user-management';

export const routes: Routes = [
  {
    path: 'users',
    children: userManagementRoutes,
  },
  // Other routes...
];

Lazy-Loaded Module

// app.routes.ts
export const routes: Routes = [
  {
    path: 'users',
    loadChildren: () =>
      import('@gograb-space/user-management').then((m) => m.userManagementRoutes),
  },
];

Security Features

1. Event Emission

When authorization fails, the system emits events for monitoring:

• authorization.denied - Permission denied
• access.denied.role - Role access denied

2. Logging

All authorization failures are logged with:

• User ID
• Tenant ID
• Resource/Action or Role
• Timestamp
• Correlation ID

3. Redirection

Failed authorization redirects to:

• /login - Authentication failure
• /access-denied - Authorization failure

Multi-Tenancy Support

All routes are tenant-aware through the contextGuard (if configured in parent routes):

• User lists are filtered by tenant
• Permissions are evaluated within tenant context
• User operations are scoped to current tenant

Route Data Usage

Route data can be accessed in components for:

// In component
import { ActivatedRoute } from '@angular/router';

constructor(private route: ActivatedRoute) {}

ngOnInit() {
  const routeData = this.route.snapshot.data;

  // Set page title
  document.title = routeData['title'];

  // Build breadcrumb
  const breadcrumb = routeData['breadcrumb'];

  // Check if admin-only route
  const isAdminRoute = routeData['adminOnly'];

  // Get form mode
  const mode = routeData['mode']; // 'create' or 'edit'
}

Testing Routes

// Route testing example
import { TestBed } from '@angular/core/testing';
import { Router } from '@angular/router';
import { userManagementRoutes } from '@libs-core/user-management';

describe('User Management Routes', () => {
  it('should protect routes with auth guard', () => {
    const route = userManagementRoutes.find(r => r.path === 'list');
    expect(route?.canActivate).toContain(authGuard);
  });

  it('should require users:create permission for create route', () => {
    const route = userManagementRoutes.find(r => r.path === 'create');
    const permGuard = route?.canActivate?.find(
      g => g.toString().includes('users:create')
    );
    expect(permGuard).toBeDefined();
  });
});

Best Practices

1. Always use helper functions for navigation to ensure consistency
2. Check permissions client-side before showing navigation links
3. Handle access-denied gracefully with user-friendly messages
4. Subscribe to authorization events for audit logging
5. Test route guards in integration tests
6. Use lazy loading to optimize bundle size
7. Leverage route data for breadcrumbs and page metadata