RBAC Phase 1: Foundation & Temporal Extensions

[kevalyq]

Phase 1 Overview

Establish RBAC foundation using Spatie Laravel-Permission with custom temporal extensions.

Tasks Completed

• Install Spatie Laravel-Permission (v6.23)
• Create migration add_temporal_columns_to_model_has_roles_table
  • valid_from, valid_until timestamps
  • auto_revoke boolean flag
  • assigned_by, reason audit fields
  • Indexed for efficient queries
• Create TemporalRoleUser pivot model
  • active() scope for current roles
  • expired() scope for revocation
  • isActive(), isExpired() helpers
  • assignedBy() relationship
• Override User::roles() relationship
  • Use custom pivot model
  • Auto-filter inactive roles
  • Include temporal columns
• Write comprehensive unit tests (12 test cases)
  • Temporal filtering (future/expired/active)
  • Scope behavior validation
  • Helper method accuracy
  • auto_revoke flag handling

Implementation Details

Files Created:

• app/Models/TemporalRoleUser.php - Custom pivot model
• database/migrations/2025_11_08_143609_add_temporal_columns_to_model_has_roles_table.php
• tests/Unit/Models/TemporalRoleUserTest.php - 12 test cases

Files Modified:

• app/Models/User.php - Added roles() override
• composer.json - Added spatie/laravel-permission ^6.23

Acceptance Criteria

• Spatie Laravel-Permission installed and configured
• Temporal columns added to pivot table
• Custom pivot model with filtering scopes
• User model integration complete
• Unit tests achieving >80% coverage
• Migration ready for deployment

Reference

• ADR-004: RBAC Architecture Decision (PR feat: File Attachments API (Phase 2) #175 #177 in .github repo)
• Parent Issue: 🔐 Implement RBAC System (Role-Based Access Control) #5 (RBAC System)

Estimated vs Actual

• Estimated: 2 days
• Actual: 0.5 days ✅ (ahead of schedule)

[github-actions]

✅ This issue has been added to the SecPal Feature Roadmap with status: 💡 Ideas

New idea - needs discussion and evaluation

Status Flow:
💡 Ideas → 💬 Discussion → 📥 Backlog → 📋 Planned → 🚧 In Progress → 👀 In Review → ✅ Done

Note: Ideas that won't be implemented should be moved to 🚫 Won't Do with a reason.