Auth & Security

RBAC Permission Matrix & Scopes

4 Role Tiers

Role-Based Access Control (RBAC) with granular scope evaluation. Simulate requests as admin, editor, viewer, or guest using custom simulation headers to test route authorization guards and HTTP 403 Forbidden responses.

Interactive Role Authorization Tester

Select an authorization scenario below to test permission enforcement on live backend endpoints:

Simulate: Admin: Delete Resource (Allowed)

DELETE

response.json

{

// Click "Send" above to execute this request against the live server.

}

Resource Permission Matrix

Authorization privileges across system collections and operational action boundaries:

Resource Domain	Read (GET)	Create (POST)	Update (PUT/PATCH)	Delete (DELETE)	Admin / Reset
Users & Profiles	All Roles	Editor, Admin	Editor, Admin	Admin Only	Admin Only
Posts & Comments	All Roles	Editor, Admin	Editor, Admin	Admin Only	Admin Only
Todos Checklist	All Roles	Editor, Admin	Editor, Admin	Admin Only	Admin Only
Media & File Uploads	All Roles	Editor, Admin	Editor, Admin	Admin Only	Admin Only
Sandbox Reset & Seeding	Editor, Admin	Admin Only	Admin Only	Admin Only	Admin Only

Programmatic RBAC Discovery Endpoints

Query system roles, persona definitions, and full permission matrix mappings directly via REST endpoints:

GET

Roles & Personas Dictionary (/auth/roles)

Returns all supported roles (admin, editor, viewer, guest), persona credentials, and default scopes:

Query Supported Roles & Personas

GET

response.json

{

// Click "Send" above to execute this request against the live server.

}

GET

Granular Permission Matrix (/auth/permissions)

Returns the system permission matrix, allowed action verbs per role, and wildcard matching syntax (*:read, posts:*):

Query Granular Permission Matrix

GET

response.json

{

// Click "Send" above to execute this request against the live server.

}

Frontend Authorization Guard Recipes

Patterns for protecting sensitive components and action buttons in React 19:

authGuards.tsx

// React 19 / Next.js <PermissionGuard /> Component

import React from 'react';

import { useAuth } from '@/hooks/useAuth';

interface PermissionGuardProps {

requiredRole?: 'admin' | 'editor' | 'viewer';

requiredScope?: string;

fallback?: React.ReactNode;

children: React.ReactNode;

}

export function PermissionGuard({

requiredRole,

requiredScope,

fallback = null,

children,

}: PermissionGuardProps) {

const { user } = useAuth();

if (!user) return <>{fallback}</>;

// Admin superuser bypasses all scope checks

if (user.role === 'admin') return <>{children}</>;

// Check role hierarchy

if (requiredRole && user.role !== requiredRole) {

if (requiredRole === 'editor' && user.role !== 'admin') {

return <>{fallback}</>;

}

// Check specific granular scope

if (requiredScope) {

const hasScope = user.scopes?.includes('*') ||

user.scopes?.includes(requiredScope) ||

user.scopes?.includes(${requiredScope.split(':')[0]}:*);

if (!hasScope) return <>{fallback}</>;

}

return <>{children}</>;

}

PreviousRefresh Token Rotation

NextExpiry Simulation