User Permissions Overview

User Permissions Overview

This document outlines the required permissions for various screens, resources, and actions within the TrackHub platform. Each permission defines the level of access granted to users for interacting with the system's components.

---

Permission Model

TrackHub implements a dual-path authorization model that combines Role-Based Access Control (RBAC) with Policy-Based Access Control (PBAC). Every request is checked against the user's assigned roles and policies to determine if access to a specific Resource + Action pair is allowed.

graph TB
    subgraph User["Authenticated User"]
        user["User<br/>(JWT Token)"]
    end

    subgraph Assignment["Access Assignment"]
        policies["Policies<br/><i>Fine-grained grants</i>"]
        roles["Roles<br/><i>Grouped permissions</i>"]
    end

    subgraph Authorization["Authorization Check"]
        resource["Resource<br/><i>e.g. Transporters</i>"]
        action["Action<br/><i>e.g. Write</i>"]
    end

    subgraph Result["Decision"]
        granted["✅ Allowed"]
        denied["❌ Denied"]
    end

    user -->|UserPolicy| policies
    user -->|UserRole| roles
    policies -->|ResourceActionPolicy| resource
    roles -->|ResourceActionRole| resource
    resource --- action
    action --> granted
    action --> denied

Loading

How It Works

1. A user sends a request (e.g., create a transporter)
2. The AuthorizationBehavior middleware intercepts the command
3. It reads the [Authorize(Resource, Action)] attribute on the handler
4. It queries the Security service: "Does this user have permission for Resource X, Action Y?"
5. The Security service checks both the policy path and the role path
6. Access is granted if either path resolves to a match

---

Permissions by Screen

Dashboard

The main operational screen showing the live map and transporter positions.

Resource	Actions	Description
Credentials	Custom, Read	Custom: update token/refresh token of operator if required
Devices	Read	View devices on the map
Geofencing	Read	View geofence boundaries on the map
Operators	Read	View operator information
Positions	Custom, Read	Custom: update local transporter position; Read: view positions
Transporter Type	Read	View transporter type classifications

Account Management

Administration of account-level entities: users, groups, transporters, devices, and operators.

Resource	Actions	Description
Accounts	Edit, Read	View and modify account settings
Devices	Delete, Read, Write	Full device lifecycle management
Groups	Delete, Edit, Read, Write	Manage user/transporter groups
Operators	Delete, Edit, Read, Write	Manage GPS provider operators
Permissions	Read	View assigned permissions
Transporters	Delete, Edit, Read, Write	Manage vehicles/assets
Users	Custom, Delete, Edit, Read, Write	Custom: update user password

Geofences

Create, edit, and monitor geofence zones on the map.

Resource	Actions	Description
Geofences	Delete, Edit, Read, Write	Full geofence lifecycle management

Reports

Generate and export operational reports (position history, geofence events, mileage).

Resource	Actions	Description
Reports	Read	Generate and download reports

Profile

User self-service for personal settings.

Resource	Actions	Description
Profile	Edit, Read	View and update own profile

System Administration

Platform-level administration for super administrators.

Resource	Actions	Description
Accounts	Edit	Modify any account in the platform
Administrative	Edit, Read, Write	Create accounts and manager users
Permissions	Delete, Write	Manage permission assignments
Transporter Type	Edit, Read, Write	Manage the transporter type catalog
Users	Delete, Write	Manage users across accounts

---

Complete Permissions Matrix

Screen	Resource	Delete	Edit	Read	Write	Custom
Dashboard	Credentials			✅		✅
	Devices			✅
	Geofencing			✅
	Operators			✅
	Positions			✅		✅
	Transporter Type			✅
Account Mgmt	Accounts		✅	✅
	Devices	✅		✅	✅
	Groups	✅	✅	✅	✅
	Operators	✅	✅	✅	✅
	Permissions			✅
	Transporters	✅	✅	✅	✅
	Users	✅	✅	✅	✅	✅
Geofences	Geofences	✅	✅	✅	✅
Reports	Reports			✅
Profile	Profile		✅	✅
System Admin	Accounts		✅
	Administrative		✅	✅	✅
	Permissions	✅			✅
	Transporter Type		✅	✅	✅
	Users	✅			✅

---

Action Definitions

Action	Description
Read	View/query the resource
Write	Create new records
Edit	Update existing records
Delete	Remove records
Custom	Special operations (e.g., password update, token refresh, position sync)

---

Implementation Details

Authorization Attribute

Commands and queries are decorated with the [Authorize] attribute specifying the required resource and action:

[Authorize(Resource = Resources.Transporters, Action = Actions.Write)]
public readonly record struct CreateTransporterCommand(TransporterDto Transporter)
    : ICommand<TransporterVm>;

Pipeline Enforcement

The AuthorizationBehavior in the CQRS mediator pipeline automatically enforces permissions before the handler executes:

Request → Logging → Validation → Authorization → Caching → Rate Limiting → Handler
                                      ↑
                              Checks [Authorize]
                              attribute via
                              IIdentityService

If the user lacks the required permission, the request is rejected with an authorization error before reaching the handler.