# Roles, Permissions, and Access Control

## Authentication

The app uses a global authentication filter that redirects unauthenticated requests to `/auth/login`.

Public exceptions:

- `/`
- `/auth/*`

Everything else requires a logged-in session.

## Authorization Model

Authorization is enforced through a combination of:

- **Role checks** in controllers (e.g., Shopkeeper-only pages).
- **Permission checks** (`permissionCheck('some_code')`) which redirect to `/errors/denied` if the user lacks the permission.

## Roles

The system uses a roles table and includes (at minimum):

- Admin
- Manager
- Shopkeeper
- Customer

Rewarder migrations ensure Shopkeeper and Customer roles exist.

## Rewarder Permission Codes

Rewarder-related permissions include:

- Subscriptions: `subscriptions_list`, `subscriptions_add`, `subscriptions_edit`, `subscriptions_delete`
- Shops: `shops_list`, `shops_add`, `shops_edit`, `shops_delete`
- Admin shop subscription assignment: `shop_subscriptions_manage`
- Shopkeeper: `shop_products_manage`, `shop_services_manage`, `shop_discounts_manage`, `shop_rewards_manage`, `shop_orders_manage`
- Customer: `user_wallet_view`, `user_discounts_view`, `user_orders_view`

Default grants (from migration):

- Admin: all Rewarder permissions above
- Shopkeeper: product/service/discount/reward/order manage permissions
- Customer: wallet/discounts/orders view permissions

## Practical Access Rules (Current UI)

- **Guest**: can access the home page (`/`) and see the shop list.
- **Customer**: can access `/user/*` pages (dashboard, discounts, wallet, orders).
- **Shopkeeper**: can access `/shopkeeper/*` pages (dashboard, products, services, discounts, rewards, orders).
- **Admin/Manager**: can access admin controllers (subscriptions, shops, orders, wallets/ledger, etc.).
