RBAC — Roles & Permissions

Overview

The RBAC (Role-Based Access Control) system manages all authorization in the Sutomo platform. It is built on Spatie Permission and integrated via Filament Shield. Every user action — viewing a page, creating a record, editing settings — is gated by a permission check.

Key Concepts

Concept	Description
Role	A named group of permissions (e.g., super_admin, admin, teacher, staff). Users are assigned one or more roles.
Permission	A granular access right (e.g., ViewGeneral:SystemSetting, EditCandidate:Candidate).
Guard	The auth guard the permission applies to (web for admin panel, api for API).
Super Admin	Bypasses all permission checks. Defined via filament-shield.super_admin config.

---

Permission Naming Convention

Permissions follow the convention:

{Action}{Resource}:{Module}

Part	Example	Description
Action	View, Create, Edit, Delete	The operation being gated
Resource	General, Mail, Candidate	The feature or page being accessed
Module	SystemSetting, Candidate	The module scope (PascalCase)

Examples:

• ViewGeneral:SystemSetting — View general settings page
• EditMail:SystemSetting — Edit mail configuration
• ViewAny:Candidate — List all candidates
• Delete:Candidate — Delete a candidate record

---

Flowchart — Permission Check

The following flowchart illustrates how permissions are evaluated when a user performs an action:

Explanation:

1. When a user attempts an action, authentication is checked first.
2. The permission key is resolved from the Filament resource/page (e.g., ViewGeneral:SystemSetting).
3. Filament Shield middleware checks the authorization gate against the user's assigned roles.
4. Super admin users bypass all permission checks.
5. Unauthorized access results in a 403 Forbidden response.

---

Data Flow Diagram

Level 1 — RBAC System

---

Activity Diagram — Role Assignment Lifecycle

---

Database

Entity Relationship Diagram

Key Tables

Table	Purpose
roles	Named role definitions with guard
permissions	Granular permission definitions with guard
role_has_permissions	Maps which permissions belong to each role
model_has_roles	Maps which roles are assigned to each user
model_has_permissions	Direct permission assignments (rarely used)

---

Key Files

app/
└── Filament/
    └── Resources/
        └── Candidates/
            └── CandidateResource.php    # Example: HasShieldPermissions

config/
├── permission.php                       # Spatie Permission config
└── filament-shield.php                  # Filament Shield config

└── Providers/
    └── FilamentServiceProvider.php      # Shield registration