Authorization (RBAC)

Shell uses Casbin for role-based access control. Permissions follow the resource:action pattern and are enforced via the @authorize() decorator and an RBAC middleware.

How it works

Request → JwtAuthStrategy (verify token) → RBACMiddleware (inject RBACService) → @authorize() decorator → handler

The Casbin model file is loaded from config/rbac_model.conf relative to process.cwd():

• Dev: shell/api/config/rbac_model.conf
• Prod (K8s): /app/config/rbac_model.conf

tsc does not copy .conf files

rbac_model.conf lives in shell/api/config/ (outside src/). The Dockerfile explicitly copies it: COPY shell/api/config ./config. Do not move it inside src/.

---

@authorize() usage

import { authorize } from '@/middleware/rbac.middleware';

@api({ basePath: '/api/users' })
export class UserController extends BaseController {

  @get('/')
  @authorize(['users:list'])
  async listUsers(ctx: Context) { ... }

  @post('/')
  @authorize(['users:write'])
  async createUser(ctx: Context) { ... }

  @del('/:id')
  @authorize(['users:delete'])
  async deleteUser(ctx: Context) { ... }
}

Pass multiple permissions to require all of them:

@authorize(['users:write', 'organizations:read'])

---

Permission reference

Permission	Description
users:list	List all users
users:read	Read user detail
users:write	Create or update users
users:delete	Delete users
roles:list	List roles
roles:read	Read role detail
roles:write	Create or update roles
roles:delete	Delete roles
permissions:list	List all permissions
permissions:read	Read permission detail
apps:list	List registered services
apps:read	Read service detail
apps:write	Register or update services
apps:delete	Delete services
organizations:list	List organizations
organizations:read	Read org detail
organizations:write	Update organizations
onboarding:list	List onboarding requests
onboarding:read	Read request detail
onboarding:approve	Approve onboarding request
onboarding:reject	Reject onboarding request
plans:list	List subscription plans
plans:read	Read plan detail
plans:write	Create or update plans
subscriptions:read	Read subscription status
subscriptions:write	Manage subscriptions
subscriptions:admin	Admin override subscription
settings:read	Read platform settings
settings:write	Update platform settings

---

Managing policies via API

Assign permissions to roles:

POST /api/roles/:id/permissions
Authorization: Bearer <shell-jwt>
Content-Type: application/json

{ "permissionIds": ["perm-uuid-1", "perm-uuid-2"] }

Assign roles to users:

POST /api/users/:id/roles
Authorization: Bearer <shell-jwt>
Content-Type: application/json

{ "roleIds": ["role-uuid"] }