> For the complete documentation index, see [llms.txt](https://pavewise.gitbook.io/pavewise-style-guide-and-more/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pavewise.gitbook.io/pavewise-style-guide-and-more/backend/database-tables/roles-permissions.md).

# Roles / Permissions

Just putting this here for now\...

***

**Overview**

* **Current**
  * **"role.name"-based authorization**
* **Future**
  * **"role.permissions"-based authorization**
    * Example setup
      * [**Frontend**](#frontend)
      * [**Backend** ](#backend)
    * Implementation versions:
      * [**Single role per user**](#single-role-per-user) (user.role)
      * [**Many roles per user**](#many-roles-per-user) (user.roles)

***

## Example Setup

### Frontend (e.g. allowing custom roles per company)

{% hint style="info" %}
Custom roles like this could be in addition to our "default roles": Admin, Project Manager, Read-only, etc.
{% endhint %}

<figure><img src="/files/QtxSrg8odxwn32kGt8Me" alt=""><figcaption></figcaption></figure>

### Backend

<figure><img src="/files/a8tZlXLdPfqIJvFJpZ6Z" alt=""><figcaption></figcaption></figure>

```ruby
## example implementation of limited / field supervisor-type role ("canOnlyIfOriginatedData")
## (Admin 'canOnlyIfOriginatedData' fields would be 'false')
{
    "name": 'Field Supervisor',
    "description": 'This role can view all data, and can conditionally create, update, and delete data',
    "permissions": {
        'projects': {
            'canCreate': false,
            'canRead': false,
            'canUpdate': false,
            'canDelete': false,
            'canUpdateRelationships': false
        },
        'equipment': {
            'canCreate': true,
            'canRead': true,
            'canUpdate': true,
            'canDelete': true,
            'canOnlyIfOriginatedData': true,
        },
        'production_goals': {
            'canCreate': true,
            'canRead': true,
            'canUpdate': true,
            'canDelete': true,
            'canOnlyIfOriginatedData': true
        },
        # ...
    }
}
```

***

## Single role per user

<figure><img src="/files/XmDnjscdvBS8Rozry3dr" alt=""><figcaption></figcaption></figure>

*^ ...validating the 'permissions' structure to maintain integrity*

## Many roles per user

<figure><img src="/files/DIEycRSXwvZf0ZTijbyd" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/HZRIDkVA6FkzbjXBq8IT" alt=""><figcaption></figcaption></figure>