Architecture: How to implement unified role-based access control across al...

Documentation for Sessions

🏗️ Architecture: How to implement unified role-based access control across al...

Date: 2026-02-11
Time: 04:46:55 UTC
Session: gspace1-105.2
Agent: backend
Confidence: 95%
Status: ✅ Documented

📋 Decision Context

Question:

How to implement unified role-based access control across all backend APIs?

Task: Session 105: Admin/Dev Apps Overhaul - Permission System

🎯 Decision Made

Chosen:

Create @Roles() decorator + RolesGuard in @libs-api/auth-core with role hierarchy support. Centralize ADMIN_ROLES constant. Use SystemRoles enum from @libs-core/shared-models.

Options Considered:

Create per-backend role guards
Create shared @Roles decorator in auth-core with hierarchy
Use middleware instead of guards

💭 Reasoning

The existing codebase had ADMIN_ROLES duplicated 9 times across 5 app.service.ts and 4 system.controller.ts files. No @Roles decorator existed. The SystemRoles enum was defined but unused. Adding to auth-core (shared by all backends) ensures every backend can use the same guard. Role hierarchy (DEVELOPER > ADMIN > MANAGER > USER > VIEWER) allows a developer to access admin routes without listing both roles.

📁 Files Involved

libs/libs-api/auth-core/src/lib/guards/roles.guard.ts
libs/libs-api/auth-core/src/lib/decorators/roles.decorator.ts
libs/libs-api/auth-core/src/lib/decorators/require-permission.decorator.ts
libs/libs-api/auth-core/src/lib/auth-core.constants.ts

🔗 Related

Decision ID: dev_1770785215895_k8xfo1g
Session: 105
Workspace: gspace1

Auto-generated by MCP Smart Consolidation