Ilham Akbari Winoto Full-Stack Developer

← Back to list feature

Role-Based Access Control - Module-Level Granularity

mst_modules + role_module pivot + module:xxx middleware - CRUD-level granularity without hardcoded role checks.

Role and permission flow diagram. — Request passes auth:sanctum, then module:xxx middleware, then role_module lookup.

Problem

Role checks were scattered, hard to audit and refactor.

Decision

Centralize on mst_modules + role_module + module:xxx middleware.

Result

50+ module-gated routes, CRUD-level granularity, single source of truth.

Implementation

All primary routes are module-gated; CRUD-level granularity (read/create/update/delete).
Adding a new module only requires seeding mst_modules + role_module, no code change.

Related screenshots

StockFlow admin sidebar showing all modules the admin role can access. — Sidebar rendered from the BE response based on the admin role_module rows.

StockFlow staff sidebar with fewer modules than the admin sidebar. — master-items, user-management, and role-management modules are filtered out for staff.