Role-Based Access Control (RBAC) & Permissions

BonardaHR enforces a fine-grained Role-Based Access Control security model. Permissions are strings declared on the backend and mapped to constants in src/shared/constants/permissions.ts.

---

Permissions Catalog

// shared/constants/permissions.ts
export const Permissions = {
  // Employee Permissions
  EMPLOYEE_CREATE: 'EMPLOYEE_CREATE',
  EMPLOYEE_READ: 'EMPLOYEE_READ',
  EMPLOYEE_READ_ALL: 'EMPLOYEE_READ_ALL',
  EMPLOYEE_READ_TEAM: 'EMPLOYEE_READ_TEAM',
  EMPLOYEE_UPDATE: 'EMPLOYEE_UPDATE',
  EMPLOYEE_DELETE: 'EMPLOYEE_DELETE',
  EMPLOYEE_IMPERSONATE: 'EMPLOYEE_IMPERSONATE',
  IMPERSONATION_AUDIT_READ: 'IMPERSONATION_AUDIT_READ',

  // Time-Off Permissions
  TIME_OFF_TYPE_CREATE: 'TIME_OFF_TYPE_CREATE',
  TIME_OFF_TYPE_READ: 'TIME_OFF_TYPE_READ',
  TIME_OFF_TYPE_UPDATE: 'TIME_OFF_TYPE_UPDATE',
  TIME_OFF_TYPE_DELETE: 'TIME_OFF_TYPE_DELETE',
  TIME_OFF_REQUEST_CREATE: 'TIME_OFF_REQUEST_CREATE',
  TIME_OFF_REQUEST_READ_OWN: 'TIME_OFF_REQUEST_READ_OWN',
  TIME_OFF_REQUEST_READ_TEAM: 'TIME_OFF_REQUEST_READ_TEAM',
  TIME_OFF_REQUEST_READ_ALL: 'TIME_OFF_REQUEST_READ_ALL',
  TIME_OFF_REQUEST_APPROVE: 'TIME_OFF_REQUEST_APPROVE',
  TIME_OFF_BALANCE_READ_OWN: 'TIME_OFF_BALANCE_READ_OWN',
  TIME_OFF_BALANCE_READ_ALL: 'TIME_OFF_BALANCE_READ_ALL',
  TIME_OFF_BALANCE_ADJUST: 'TIME_OFF_BALANCE_ADJUST',

  // Timesheet Permissions
  TIMESHEET_CREATE: 'TIMESHEET_CREATE',
  TIMESHEET_READ_OWN: 'TIMESHEET_READ_OWN',
  TIMESHEET_READ_TEAM: 'TIMESHEET_READ_TEAM',
  TIMESHEET_READ_ALL: 'TIMESHEET_READ_ALL',
  TIMESHEET_SUBMIT: 'TIMESHEET_SUBMIT',
  TIMESHEET_APPROVE: 'TIMESHEET_APPROVE',
  TIMESHEET_REOPEN: 'TIMESHEET_REOPEN',
  TIMESHEET_SUBMIT_ON_BEHALF: 'TIMESHEET_SUBMIT_ON_BEHALF',

  // Attendance Policy Permissions
  ATTENDANCE_POLICY_READ: 'ATTENDANCE_POLICY_READ',
  ATTENDANCE_POLICY_CREATE: 'ATTENDANCE_POLICY_CREATE',
  ATTENDANCE_POLICY_UPDATE: 'ATTENDANCE_POLICY_UPDATE',
  ATTENDANCE_POLICY_DELETE: 'ATTENDANCE_POLICY_DELETE',
  ATTENDANCE_POLICY_ASSIGN: 'ATTENDANCE_POLICY_ASSIGN',

  // Document & E-Sign Permissions
  DOCUMENT_CREATE: 'DOCUMENT_CREATE',
  DOCUMENT_READ_OWN: 'DOCUMENT_READ_OWN',
  DOCUMENT_READ_ALL: 'DOCUMENT_READ_ALL',
  DOCUMENT_UPDATE: 'DOCUMENT_UPDATE',
  DOCUMENT_DELETE: 'DOCUMENT_DELETE',
  DOCUMENT_SHARE: 'DOCUMENT_SHARE',
  DOCUMENT_SIGN_OWN: 'DOCUMENT_SIGN_OWN',
  DOCUMENT_SIGN_READ: 'DOCUMENT_SIGN_READ',
  SHAREPOINT_BROWSE: 'SHAREPOINT_BROWSE',

  // Role & Admin Permissions
  ROLE_CREATE: 'ROLE_CREATE',
  ROLE_READ: 'ROLE_READ',
  ROLE_UPDATE: 'ROLE_UPDATE',
  ROLE_DELETE: 'ROLE_DELETE',
  ROLE_ASSIGN: 'ROLE_ASSIGN',

  // Workflow Permissions
  WORKFLOW_APPROVE: 'WORKFLOW_APPROVE',
  WORKFLOW_INSTANCE_READ_OWN: 'WORKFLOW_INSTANCE_READ_OWN',
  WORKFLOW_INSTANCE_READ_ALL: 'WORKFLOW_INSTANCE_READ_ALL',
  WORKFLOW_INSTANCE_CANCEL: 'WORKFLOW_INSTANCE_CANCEL',
  WORKFLOW_TRIGGER: 'WORKFLOW_TRIGGER',
  WORKFLOW_TEMPLATE_READ: 'WORKFLOW_TEMPLATE_READ',
  WORKFLOW_TEMPLATE_CREATE: 'WORKFLOW_TEMPLATE_CREATE',
  WORKFLOW_TEMPLATE_UPDATE: 'WORKFLOW_TEMPLATE_UPDATE',
  WORKFLOW_TEMPLATE_DELETE: 'WORKFLOW_TEMPLATE_DELETE',
} as const;

---

Checking Permissions in UI Components

1. In Hooks & Logic (useAuth)

import { useAuth } from '../features/auth/hooks/useAuth';
import { Permissions } from '../shared/constants/permissions';

export function EmployeeActions() {
  const { hasPermission } = useAuth();

  const canEdit = hasPermission(Permissions.EMPLOYEE_UPDATE);
  const canDelete = hasPermission(Permissions.EMPLOYEE_DELETE);

  return (
    <div className="flex gap-2">
      {canEdit && <button onClick={handleEdit}>Edit</button>}
      {canDelete && <button onClick={handleDelete}>Delete</button>}
    </div>
  );
}

2. In Route Definitions (PermissionGuard)

<Route
  path="/employees/new"
  element={
    <PermissionGuard permission={Permissions.EMPLOYEE_CREATE}>
      <CreateEmployeeWizard />
    </PermissionGuard>
  }
/>