Skip to main content

Security and Permissions

⚠️ UPDATED by the 2026-06 access-model redesign — see access-model.md (authoritative). AxveroRolePermissionEvaluator's methods are now thin delegations to AccessService.can / canOrg / canViewApplication (union of the user's roles in the 1:1-paired team, org-scoped matrix, feature gate). There is no OWNER bypass any more — only SUPERADMIN short-circuits; OWNER is a narrow org role (billing) and operates workspaces via an auto-seated ADMIN Member. Membership guards no longer match hardcoded role lists (that excluded custom OrgRoleDefinition codes). Capability matrix is org-scoped. The evaluator method names below still exist (same SpEL surface); their logic moved into AccessService.

  • Keycloak OAuth2; custom AxveroRolePermissionEvaluator checks roles via MemberRepository
  • MemberRole enum maintains roles
  • Cascading Permissions: hasUserAnyRoleForTeam checks team → workspace → org
  • Automatic Creator Membership: creators are added as OWNER when creating teams/orgs
  • Class-level @PreAuthorize("isAuthenticated()") on all GraphQL controllers; method-level narrows further
  • OnboardingFilter handles JWT extraction and user onboarding

Evaluator method names​

Membership checks — used on read/query endpoints​

  • hasUserAnyOrgRole(orgId, roles...)
  • hasUserAnyTeamRole(teamId, roles...)
  • hasUserAnyWorkspaceRole(workspaceId, roles...)
  • hasUserAnyRoleForTeam(teamId, roles...) — cascading: team → workspace → org
  • hasUserAnyWorkspaceOrClientRole(workspaceId, clientId, roles...)

Permission matrix checks — used on write/mutation endpoints​

  • hasUserSystemPermission(orgId, permissionName)
  • hasUserApplicationPermission(workspaceId, permissionName)
  • hasUserSystemPermissionForTeam(teamId, permissionName)
  • hasUserSystemPermissionForClient(clientId, permissionName)
  • hasUserAppPermissionForApplication(applicationId, permissionName)
  • hasUserAppPermissionForApplicant(applicantId, permissionName)
  • hasUserAppPermissionForComment(commentId, permissionName)

For the full permission matrix — entities, services, default values, frontend hooks, how to add a permission — see docu/docs/ai/claude/rules/permissions.md.