Permissions & Roles

The app uses Role-Based Access Control (RBAC).

Frontend: Uses server-computed permissions.
Backend: The source of truth (go-b2b-starter/src/pkg/auth/rbac.go).

Checking Permissions

In React Components

File: lib/hooks/use-permissions.ts

import { usePermissions } from '@/lib/hooks/use-permissions';

export function EditButton() {
  const { hasPermission, hasRole } = usePermissions();

  // Check Permission
  if (hasPermission('resource:edit')) {
    return <button>Edit</button>;
  }
  
  // Check Role
  if (hasRole('admin')) {
    return <AdminBadge />;
  }
  
  return null;
}

In API Routes

File: lib/auth/server-permissions.ts

import { getServerPermissions } from '@/lib/auth/server-permissions';

export async function POST(req) {
  const session = await requireMemberSession();
  const permissions = await getServerPermissions(session);
  
  if (!permissions.canCreateResources) {
    return NextResponse.json({ error: 'Forbidden' }, { status: 403 });
  }
}

Available Roles

Defined in go-b2b-starter/src/pkg/auth/roles.go.

Admin: Full access (*).
Manager: Can view, create, edit, delete, approve.
Member: Can view, create.

Permissions Format

resource:view
resource:create
resource:edit
resource:delete
resource:approve
org:manage

Next Steps

👉 Learn about: Payments & Billing

1.5 KiB Raw Permalink Blame History