Access control / RBAC

Two parallel permission systems: the canonical Convex ladder (10 roles x preview/edit/upload/download/delete) and a separate Supabase-backed table read by permissionUtils for file operations.

What it is and how it feeds the rest

Mechanically

Two parallel permission systems: the canonical Convex ladder (10 roles x preview/edit/upload/download/delete) and a separate Supabase-backed table read by permissionUtils for file operations.

How it connects

Render-gates the UI. Enforcement is cosmetic — no Convex function checks a role.

Components

src/components/admin/

Convex modules

rolePermissions.ts
accessUsers.ts

Tables

rolePermissions
profiles

Findings that touch this domain

critical Zero server-side authentication — ctx.auth appears 0 times in 36 modules; 221 public vs 22 internal functions

convex/*.ts

medium 39 files still import the Supabase client; 15 of them in components/payroll

src/**

medium Permissions render-gate the UI only; no Convex function checks a role

convex/rolePermissions.ts vs src/utils/permissionUtils.ts

Open questions

Research priority for this domain is medium. Agent findings splice in below this line and survive regeneration.