role-based-access-patterns

Role-Based Access Control (RBAC) Patterns

Role Definitions

Available Roles

type UserRole = 'admin' | 'manager' | 'server' | 'counter' | 'kitchen'

Role Capabilities

• admin: Full system access, can switch to any interface
• manager: Business operations, reports, staff oversight
• server: Dine-in order creation only
• counter: All order types + payment processing
• kitchen: Order preparation and status updates

Frontend Role Routing

Main Router Pattern

// RoleBasedLayout.tsx
export function RoleBasedLayout({ user }: { user: User }) {
  // Admin gets AdminLayout with all interfaces
  if (user.role === 'admin') {
    return <AdminLayout user={user} />
  }
  
  // Other roles get specific interfaces
  switch (user.role) {
    case 'server': return <ServerInterface />
    case 'counter': return <CounterInterface />
    case 'kitchen': return <KitchenLayout user={user} />
    default: return <POSLayout user={user} />
  }
}

Navigation Access Control

// AdminLayout.tsx - Admin can access all interfaces
const adminSections = [
  { id: 'dashboard', label: 'Dashboard' },
  { id: 'pos', label: 'General POS' },        // Full POS access
  { id: 'server', label: 'Server Interface' }, // Server view
  { id: 'counter', label: 'Counter/Checkout' }, // Counter view
  { id: 'kitchen', label: 'Kitchen Display' }   // Kitchen view
  // + admin-only sections
]

Backend API Role Restrictions

Route Groups by Role

// routes.go pattern
func setupRoutes(router *gin.Engine) {
    api := router.Group("/api/v1")
    
    // Public routes
    api.POST("/auth/login", handlers.Login)
    
    // Protected routes
    protected := api.Group("", middleware.RequireAuth)
    
    // Admin only
    admin := protected.Group("/admin", middleware.RequireRole("admin"))
    admin.GET("/users", handlers.GetUsers)
    admin.POST("/users", handlers.CreateUser)
    
    // Server only
    server := protected.Group("/server", middleware.RequireRole("server"))
    server.POST("/orders", handlers.CreateDineInOrder) // Restricted to dine_in
    
    // Counter access
    counter := protected.Group("/counter", middleware.RequireRoles("counter", "admin"))
    counter.POST("/orders", handlers.CreateCounterOrder) // All order types
    counter.POST("/orders/:id/payments", handlers.ProcessPayment)
}