Module: User Profile (Me)

Introduction

The User Profile (Me) module is responsible for providing the currently authenticated user with a personalized view of their access rights and available resources. It acts as the primary interface for "Visualization Endpoints," allowing the frontend to dynamically adjust the UI—such as sidebar navigation and action buttons—based on real-time authorization checks.

The module bridges the backend's relationship-based access control (RBAC/ReBAC) logic with the frontend presentation. By querying the OpenFGA authorization engine, it determines which "tables" (resources) a user can read and what specific CRUD operations (Create, Read, Update, Delete) they are permitted to perform on those resources.
Sources: PLAN.md:143-162, frontend/src/components/Layout.tsx:49-65

Backend Architecture & Endpoints

The backend implementation of the "Me" module is centralized under the /api/me route prefix. It utilizes the fgaClient to perform check operations against the OpenFGA store.

API Endpoints

Sources: PLAN.md:143-162, backend/src/routes/index.ts:18, frontend/src/api/endpoints.ts:109-115

Data Flow for Permission Checking

When a user requests their permissions, the backend retrieves the user ID from the JWT and calls OpenFGA to evaluate relations defined in the authorization model.

Authorization Logic

The "Me" module relies on computed relations within the OpenFGA model. Permissions are not just direct assignments but can be inherited through role memberships.

Key Logic Components

• Relationship Mapping: The backend maps generic actions (create, read, etc.) to FGA relations (can_create, can_read).
• Role Expansion: OpenFGA evaluates if a user is a member of a role, and if that role has the necessary "badges" (creator, reader, updater, deleter) for a specific table.
• Check Functions: checkPermission is the core utility used to verify if a user:<id> has a specific can_<action> relation to a table:<slug>.

Sources: backend/src/fga/fgaClient.ts:77-94, PLAN.md:33-47

Frontend Implementation

Sidebar Navigation

The Layout component uses the /me/allowed-tables endpoint to filter the navigation menu. Tables are only rendered in the sidebar if the user has read access, ensuring a clean and secure user experience.
Sources: frontend/src/components/Layout.tsx:49-65

Action Visualization

In individual resource pages (e.g., TablePage), the UI fetches specific permissions to enable or disable interaction elements.

My Permissions Summary

The MyPermissionsPage provides a comprehensive overview for the user. It iterates through all allowedTables and performs a permission check for each to display a status matrix.
Sources: frontend/src/pages/MyPermissionsPage.tsx:14-25

Data Structures

The following TypeScript interfaces define the shape of the data exchanged within this module:

export type AllowedTablesResponse = {
  tables: Array<{ slug: string; displayName: string }>;
};

export type TablePermissionsResponse = {
  table: string;
  canCreate: boolean;
  canRead: boolean;
  canUpdate: boolean;
  canDelete: boolean;
};

Sources: frontend/src/api/endpoints.ts:37-48

Conclusion

The User Profile (Me) module is the primary consumer of the project's authorization engine for end-user features. By abstracting complex OpenFGA relationship queries into simple boolean flags, it allows the frontend to stay decoupled from the underlying security model while providing immediate, permission-aware feedback to the user.