RBAC & Permission Middleware

Relevant source files

The following files were used as context for generating this wiki page:

• src/middlewares/permission.ts
• src/controllers/rolePermissionController.ts
• src/services/rolePermissionService.ts
• src/routes/rolePermissionRoutes.ts
• prisma/schema.prisma
• prisma/seed.ts
• src/schemas/rolePermission.ts

The Role-Based Access Control (RBAC) and Permission Middleware system provides a granular security layer for the Outmanage API. It ensures that users can only access resources and perform actions explicitly permitted by their assigned roles. The system manages the relationships between users, roles, and permissions, while enforcing access constraints through specialized Express middleware.

This module works in conjunction with the authentication system to validate user identity and subsequently authorize specific operations based on a predefined set of resource-action pairs. Sources: src/middlewares/permission.ts:15-18, prisma/seed.ts:32-40

Data Model & Schema

The RBAC system is built upon four primary entities within the Prisma schema: User, Role, Permission, and RolePermission.

Entity Relationships

The diagram shows the many-to-many relationship between Roles and Permissions, resolved by the RolePermission join table. Sources: prisma/schema.prisma:45-85

Permission Structure

Permissions are defined by a resource (the entity being accessed) and a PERMISSION_ACTION.

Field	Type	Description
resource	String	The entity name (e.g., 'user', 'shipment', 'warehouse')
action	Enum	Actions: CREATE, READ, UPDATE, DELETE, WEIGH, VERIFY_PLATE, etc.
name	String	Unique identifier formatted as resource:action

Sources: prisma/schema.prisma:67-78, prisma/seed.ts:133-146

Middleware Enforcement

Access control is enforced at the routing level using three primary middleware functions located in src/middlewares/permission.ts.

checkPermission

This is the standard middleware used for most protected routes. It verifies if the authenticated user's roleId has the specific permission mapped to the requested resource and action.

checkWarehouseAccess

A specialized security layer that ensures users only access products belonging to their assigned warehouse. This logic includes an "override" mechanism: if a user has the CHOSE_PRODUCT permission (typically reserved for drivers or global managers), they can bypass the warehouse restriction. Sources: src/middlewares/permission.ts:140-205

checkAnyPermission

A higher-order middleware that accepts an array of permission requirements. It allows access if the user satisfies any of the provided resource-action pairs. Sources: src/middlewares/permission.ts:84-132

Role & Permission Management

The system provides endpoints and services to manage the assignment of permissions to roles.

Permission Update Logic

The differentialUpdateRolePermissions service implements a toggle mechanism. When a list of permission IDs is provided for a role, the system iterates through them: if the role already has the permission, it is removed; if it does not, it is added. Sources: src/services/rolePermissionService.ts:57-89

API Endpoints

Method	Endpoint	Description	Middleware
GET	/api/role-permissions/:roleId	Retrieve all permissions for a role	None
PUT	/api/role-permissions/:roleId/update-all	Toggle permissions for a role	checkPermission('permission', 'UPDATE')
GET	/api/permissions	Get all available system permissions	checkPermission('permission', 'READ')

Sources: src/routes/rolePermissionRoutes.ts:1-15, src/controllers/rolePermissionController.ts:11-55

System Seeding & Initialization

The prisma/seed.ts file defines the initial state of the RBAC system, including the creation of the "Pemilik" (Owner) role which is granted every possible permission in the system.

Resource Coverage

The seeding process automatically generates permissions for the following core resources:

• Core Entities: user, role, permission, warehouse, product, customer, armada, delivery_order, shipment.
• Audit Logs: user_log, product_log, customer_log, warehouse_log, armada_log, shipment_log.
• Special Actions: supir, report, driver.

Sources: prisma/seed.ts:43-62, prisma/seed.ts:148-170

Sequence: Permission Validation

Conclusion

The RBAC system provides a robust framework for securing the logistics platform. By decoupling permissions from specific users and instead linking them to roles, the system allows for flexible administrative control. The inclusion of warehouse-specific access checks further refines the security model to support multi-tenant or multi-facility operational requirements. Sources: src/middlewares/permission.ts:140-150, prisma/seed.ts:205-215