Role Scope Resolver
Component Detail
Service Layer
low complexity
Shared Component
backend
0
Dependencies
1
Dependents
5
Entities
0
Integrations
Description
Shared service that determines the data visibility scope for the authenticated user based on their role. Coordinators are scoped to their local association; org admins are scoped to their full organization. Used consistently across dashboard KPIs, the activity feed, and reporting endpoints to enforce data isolation.
role-scope-resolver
Responsibilities
- Resolve organizationId or localAssociationId scope from JWT claims
- Return scope descriptor used in WHERE clause construction
- Enforce that global admins cannot access org-level operational data by default
Interfaces
resolveScope(user: AuthUser): DataScope
getScopeWhereClause(scope): SQLFragment
isScopedToLocalAssociation(user): boolean
isScopedToOrganization(user): boolean
Relationships
Related Data Entities (5)
Data entities managed by this component