Role Guard Service
Component Detail
Description
Backend middleware that intercepts every authenticated API request, reads the role claim from the validated JWT, and evaluates it against the minimum required role for the targeted endpoint. Returns HTTP 403 when the caller's role is insufficient, eliminating the need for per-handler role checks.
role-guard-service
Sources & reasoning
The feature description explicitly names the Role Guard Service as the backend enforcement mechanism that returns 403 on role violations. It must also handle the Global Admin time-bounded support-access constraint and audit logging, as described in the source doc. Role claims in the JWT make per-request enforcement cheap - no extra DB lookup per request except for Global Admin support-access expiry checks.
No source references — this artifact was included based on reasoning alone (see above).
Responsibilities
- Extract and validate role claim from the incoming JWT on every request
- Compare caller role against the endpoint's required minimum role
- Return 403 Forbidden with a structured error body when role is insufficient
- Log Global Admin support-access sessions to audit_logs with org and timestamp
- Enforce time-bounded Global Admin support access expiry via organization_settings flag
Interfaces
guard(req, requiredRole) → void | 403
extractRoleClaim(jwt) → RoleEnum
isGlobalAdminSupportAccessAllowed(orgId) → boolean
logSupportAccessSession(globalAdminId, orgId) → void
resolveEffectiveRole(userId, orgId) → RoleEnum
Relationships
Dependencies (3)
Components this component depends on
Dependents (29)
Components that depend on this component
Related Data Entities (25)
Data entities managed by this component