Access control / RBAC

Two parallel permission systems: the canonical Convex ladder (10 roles x preview/edit/upload/download/delete) and a separate Supabase-backed table read by permissionUtils for file operations.

What it is and how it feeds the rest

Mechanically

Two parallel permission systems: the canonical Convex ladder (10 roles x preview/edit/upload/download/delete) and a separate Supabase-backed table read by permissionUtils for file operations.

How it connects

Render-gates the UI. Enforcement is cosmetic — no Convex function checks a role.

Components

src/components/admin/

Convex modules

rolePermissions.ts
accessUsers.ts

Tables

rolePermissions
profiles

Findings that touch this domain

critical Zero server-side authentication — ctx.auth appears 0 times in 36 modules; 221 public vs 22 internal functions

convex/*.ts

medium 39 files still import the Supabase client; 15 of them in components/payroll

src/**

medium Permissions render-gate the UI only; no Convex function checks a role

convex/rolePermissions.ts vs src/utils/permissionUtils.ts

The decision — what we do here

TRANSPLANT — casl collapses the two permission systems, server-enforced.

Repos we analyzed for this domain

LIFT stalniy/casl

Isomorphic RBAC — collapses his two permission systems, server-enforced.

WRAP openfga/openfga

Relationship authz service — only if resource-sharing gets complex.

LIFT = copy the code into the fork · WRAP = run underneath as a service · STUDY = architecture only. Verdicts from the OFM sourcing campaign.

Open questions

Research priority for this domain is medium. Agent findings splice in below this line and survive regeneration.