25dad7f36f
- .NET 10 Clean Architecture: Domain/Application/Infrastructure/Api (4 project) - 2 React + Vite + TS app: fe-admin (:8082), fe-user (:8080) voi proxy /api - Node engines >=20, .nvmrc = 20 cho CI (bai hoc NamGroup) - SQL Server 2022 qua docker-compose (dev) - Parse 8 FORM -> docs/forms-spec.md (catalog + ma HD format RG-001) - Parse QUY_TRINH -> docs/workflow-contract.md (9 phase state machine + role matrix) - docs: CLAUDE.md, STATUS.md, PROJECT-MAP.md, migration-todos.md (roadmap 5 phase) - .claude/skills: 3 placeholder (contract-workflow, form-engine, permission-matrix) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
42 lines
1.5 KiB
Markdown
42 lines
1.5 KiB
Markdown
---
|
||
name: permission-matrix
|
||
description: Hệ thống phân quyền Role × MenuKey × CRUD. Sidebar gating, permission guard, seed default, reset password. Dùng khi debug access denied, gán role, menu không hiện.
|
||
when-to-use:
|
||
- "permission denied"
|
||
- "access denied"
|
||
- "menu không hiện"
|
||
- "gán role cho user"
|
||
- "reset password"
|
||
- "seed permission"
|
||
---
|
||
|
||
# Permission Matrix Skill
|
||
|
||
> **Phase 1 deliverable.** Hiện tại skill này là PLACEHOLDER.
|
||
|
||
## Context
|
||
|
||
Pattern copy từ **NamGroup** skill `permission-system` nhưng đơn giản hóa:
|
||
- 1 User có N Role
|
||
- 1 Role có ma trận (MenuKey, CRUD flags) — `Permission` table
|
||
- Không có per-user override (giữ đơn giản cho Phase 1)
|
||
- Menu tree flat 2 cấp, hardcode `MenuKey`
|
||
|
||
## Tech
|
||
|
||
- BE: `[Authorize(Policy = "Menu.Read")]` attribute
|
||
- FE: `<PermissionGuard menuKey="Contracts" action="Update">` + `usePermission().can("Contracts", "Update")`
|
||
- Resolution: API `/api/menus/me` trả về tree + permissions đã resolved theo user's roles
|
||
|
||
## Code pointers (sẽ có sau Phase 1)
|
||
|
||
- `src/Backend/SolutionErp.Domain/Identity/Permission.cs`
|
||
- `src/Backend/SolutionErp.Application/Permissions/Queries/GetMyMenuTreeQuery.cs`
|
||
- `fe-admin/src/components/PermissionGuard.tsx`
|
||
- `fe-admin/src/hooks/usePermission.ts`
|
||
|
||
## Common pitfalls (dự kiến)
|
||
|
||
- Quên refresh token sau khi admin update permission → user phải logout/login mới thấy
|
||
- MenuKey hardcode dễ typo → tập trung vào file `src/lib/menuKeys.ts` (FE) + `MenuKeys.cs` (BE const)
|