Hierarchy Access Control Service
Component Detail
Service Layer
high complexity
Shared Component
backend
2
Dependencies
1
Dependents
4
Entities
0
Integrations
Description
Resolves which nodes in the organization tree the requesting admin is authorized to view or modify. Global Admins bypass all scope restrictions, while Org Admins are limited to their own subtree as determined by their JWT organization claim and the closure table.
hierarchy-access-control-service
Responsibilities
- Determine admin scope from JWT organization claim
- Authorize read/write access per org node based on role and subtree membership
- Allow Global Admins unrestricted cross-organization visibility
- Reject unauthorized access attempts with appropriate error responses
Interfaces
isAuthorized(adminId, targetOrgId, action): boolean
resolveAdminScope(adminId): OrgScope
isGlobalAdmin(adminId): boolean
assertWithinSubtree(adminOrgId, targetOrgId): void
getAccessibleOrgIds(adminId): string[]
Relationships
Dependencies (2)
Components this component depends on
Related Data Entities (4)
Data entities managed by this component