Roles and Privileges
Authorization is privilege-based, not role-based inside this service. Each route declares the privilege it requires, and an authorization hook checks that privilege against the platform auth service on every request. If the privilege is not granted, the request is rejected with AUTH_INSUFFICIENT_PERMISSIONS (HTTP 403). A 5-second timeout guards the check.
Privilege strings follow the pattern account:<action>:<resource> where:
action∈view | create | update | deleteresource∈account, accountType, accountUser, accountHistory, address, team, costCentre, budget, budgetTransaction, contract, document, payment, paymentTerm, attribute, instance, dashboard
Privileges List
Representative privileges (each route declares the exact privilege it requires):
| Privilege | Guards |
|---|---|
account:view:account / account:create:account / account:update:account / account:delete:account |
Account CRUD, hierarchy, properties, order validation, registration |
account:create:accountUser / account:view:accountUser / account:update:accountUser / account:delete:accountUser |
Account users, team invite/membership, buyer list |
account:view:dashboard |
Account dashboard |
account:{create,view,update,delete}:team |
Teams |
account:{create,view,update,delete}:costCentre |
Cost centres |
account:{create,update,delete}:budget |
Budgets |
account:{create,view}:budgetTransaction |
Budget transaction ledger |
account:{create,view,update,delete}:contract |
Contracts |
account:{create,view,delete}:document |
Contract documents |
account:{create,view,update,delete}:payment |
Payment methods |
account:{create,view,update,delete}:paymentTerm |
Payment terms |
account:{create,view,update,delete}:attribute |
Attributes |
account:{create,update,delete}:accountType |
Account types (note: view is unguarded) |
account:view:accountHistory |
Account history |
account:{view,create,update,delete}:instance |
Instances / instance attributes |
In-account model vs platform privileges: Within an account, membership is expressed as AccountUser.type (BUYER/SELLER) and team membership — this describes who belongs to the account, not what they may do. Actual API authorization is entirely the platform privilege check above.
An “admin required” flag is declared on most routes but is not currently enforced by the authorization check — the admin distinction is expected to be encoded in the granted privileges themselves.
Revision History
2026-08-05 | AN – Page created and uploaded the contents