# Permission Matrix

Canonical list of permissions + which role gets them by default. Must stay in lockstep with:

- `apps/web-angular/src/app/core/constants/permission.constants.ts`
- `dotnet/src/Shared/Constants/PermissionConstants.cs`
- `prisma/seed.ts` (the source of seeded grants)

## Permission catalog

| Code                  | Description (TH)  | Description (EN)        |
| --------------------- | ----------------- | ----------------------- |
| `users.read`          | อ่านข้อมูลผู้ใช้  | Read users              |
| `users.write`         | แก้ไขข้อมูลผู้ใช้ | Edit users              |
| `users.delete`        | ลบผู้ใช้          | Soft-delete users       |
| `roles.read`          | อ่าน Roles        | Read roles              |
| `roles.write`         | แก้ไข Roles       | Edit role grants        |
| `audit.read`          | อ่าน Audit log    | Read audit log          |
| `documents.read`      | อ่านเอกสาร        | Read documents          |
| `documents.write`     | แก้ไขเอกสาร       | Edit / upload documents |
| `documents.delete`    | ลบเอกสาร          | Soft-delete documents   |
| `announcements.read`  | อ่านประกาศ        | Read announcements      |
| `announcements.write` | แก้ไขประกาศ       | Edit announcements      |
| `approvals.read`      | อ่านคำขออนุมัติ   | Read approvals          |
| `approvals.approve`   | อนุมัติคำขอ       | Decide an approval step |

## Default role → permission grants

| Permission            | system-admin | admin | manager | user | guest |
| --------------------- | :----------: | :---: | :-----: | :--: | :---: |
| `users.read`          |      ✓       |   ✓   |    ✓    |      |       |
| `users.write`         |      ✓       |   ✓   |         |      |       |
| `users.delete`        |      ✓       |       |         |      |       |
| `roles.read`          |      ✓       |   ✓   |         |      |       |
| `roles.write`         |      ✓       |       |         |      |       |
| `audit.read`          |      ✓       |   ✓   |         |      |       |
| `documents.read`      |      ✓       |   ✓   |    ✓    |  ✓   |       |
| `documents.write`     |      ✓       |   ✓   |    ✓    |  ✓   |       |
| `documents.delete`    |      ✓       |   ✓   |         |      |       |
| `announcements.read`  |      ✓       |   ✓   |    ✓    |  ✓   |   ✓   |
| `announcements.write` |      ✓       |   ✓   |    ✓    |      |       |
| `approvals.read`      |      ✓       |   ✓   |    ✓    |  ✓   |       |
| `approvals.approve`   |      ✓       |   ✓   |    ✓    |      |       |

## Modifying

1. Update this matrix.
2. Update `prisma/seed.ts` (the source).
3. Update `permission.constants.ts` + `PermissionConstants.cs` if a new permission code was added.
4. Update the OpenAPI security descriptions if you tagged an endpoint with the new permission.
5. Migrate existing tenants: a follow-up seed run (`pnpm db:seed`) will sync; never `DELETE FROM role_permissions` in production.

## Custom roles

Tenants may define custom roles via the admin UI. Custom roles compose from the canonical permissions only — adding a new permission code requires a code change + ADR.
