Matrice des rôles
Les rôles par défaut sont seedés à la création d'une organisation (seed_tenant_roles) et au niveau plateforme. Cette page présente les rôles réels et leurs permissions.
Rôles
Rôles plateforme (N2, organization_id IS NULL)
| Rôle | Portée | Description |
|---|---|---|
administrateur | Cross-organisation | Accès complet à toutes les fonctionnalités |
observateur | Cross-organisation | Lecture seule des organisations et statistiques |
support | Cross-organisation | Support avec accès limité |
Rôles organisation (N1, organization_id IS NOT NULL)
| Rôle | Portée | Description |
|---|---|---|
gestionnaire | Organisation | Accès complet à l'établissement |
superviseur | Organisation | Gestion et supervision |
caissier | Organisation | Encaissement et rechargement |
vendeur | Organisation | Vente de produits |
porteur | Organisation | Consultation et recharge mobile |
Rôles système
Tous ces rôles sont marqués is_system_role = true et ne peuvent pas être modifiés ni supprimés. Vous pouvez créer des rôles personnalisés supplémentaires.
Matrice des permissions (rôles organisation)
Légende : ✓ = accordé, — = non accordé.
| Permission | gestionnaire | superviseur | caissier | vendeur | porteur |
|---|---|---|---|---|---|
| Cartes | |||||
card.read | ✓ | ✓ | ✓ | ✓ | — |
card.balance.read | ✓ | ✓ | ✓ | ✓ | ✓ |
card.history.read | ✓ | ✓ | ✓ | — | ✓ |
card.create | ✓ | — | — | — | — |
card.update | ✓ | — | — | — | — |
card.delete | ✓ | — | — | — | — |
card.manage | ✓ | — | — | — | — |
card.manual_access | ✓ | ✓ | ✓ | — | — |
card.assign_new | ✓ | — | ✓ | — | — |
card.deactivate | ✓ | — | — | — | — |
card.debit.lost_card | ✓ | ✓ | — | — | — |
card.correction | ✓ | ✓ | — | — | — |
card.balance.manual_adjust | ✓ | — | — | — | — |
card.void | ✓ | — | — | — | — |
card.recharge.cash | ✓ | ✓ | ✓ | — | — |
card.recharge.mobile_money | ✓ | ✓ | — | — | ✓ |
card.holder.create | ✓ | — | — | — | — |
card.holder.update | ✓ | — | — | — | — |
card.holder.delete | ✓ | — | — | — | — |
card.link.read | ✓ | — | — | — | — |
card.link.create | ✓ | — | — | — | — |
card.link.delete | ✓ | — | — | — | — |
| Produits | |||||
product.read | ✓ | ✓ | — | ✓ | — |
product.sell | — | — | — | ✓ | — |
product.create | ✓ | — | — | — | — |
product.update | ✓ | — | — | — | — |
product.delete | ✓ | — | — | — | — |
product.manage | ✓ | — | — | — | — |
category.read | ✓ | ✓ | — | ✓ | — |
category.create | ✓ | — | — | — | — |
category.update | ✓ | — | — | — | — |
category.delete | ✓ | — | — | — | — |
| Stock | |||||
stock.read | ✓ | ✓ | ✓ | ✓ | — |
stock.adjust | ✓ | — | — | — | — |
stock.purchase | ✓ | — | — | — | — |
stock.produce | ✓ | — | — | — | — |
stock.transfer | ✓ | — | — | — | — |
| Menus | |||||
menu.read | ✓ | ✓ | ✓ | ✓ | — |
menu.create | ✓ | — | — | — | — |
menu.update | ✓ | — | — | — | — |
menu.delete | ✓ | — | — | — | — |
| Sites & POS | |||||
site.read | ✓ | ✓ | — | — | — |
site.create | ✓ | — | — | — | — |
site.update | ✓ | — | — | — | — |
site.delete | ✓ | — | — | — | — |
site.manage | ✓ | — | — | — | — |
pos.read | ✓ | ✓ | — | — | — |
pos.create | ✓ | — | — | — | — |
pos.update | ✓ | — | — | — | — |
pos.delete | ✓ | — | — | — | — |
register.read | ✓ | ✓ | ✓ | — | — |
register.open | ✓ | — | ✓ | — | — |
register.close | ✓ | — | ✓ | — | — |
| Réservations | |||||
reservation.read | ✓ | ✓ | ✓ | ✓ | — |
reservation.create | ✓ | ✓ | ✓ | — | — |
reservation.update | ✓ | ✓ | ✓ | ✓ | — |
reservation.refund | ✓ | ✓ | — | — | — |
reservation.manage | ✓ | — | — | — | — |
reservation.export | ✓ | — | — | — | — |
| Tickets | |||||
ticket.read | ✓ | ✓ | — | — | — |
ticket.create | ✓ | — | — | — | — |
ticket.update | ✓ | ✓ | — | — | — |
| Notifications | |||||
notification.read | ✓ | ✓ | — | — | — |
notification.create | ✓ | — | — | — | — |
notification.update | ✓ | — | — | — | — |
notification.delete | ✓ | — | — | — | — |
notification.manage | ✓ | — | — | — | — |
| Paramètres | |||||
settings.read | ✓ | ✓ | — | — | — |
settings.update | ✓ | — | — | — | — |
| Utilisateurs & rôles | |||||
user.read | ✓ | ✓ | — | — | — |
user.create | ✓ | — | — | — | — |
user.update | ✓ | — | — | — | — |
user.delete | ✓ | — | — | — | — |
user.manage | ✓ | — | — | — | — |
role.read | ✓ | ✓ | — | — | — |
role.create | ✓ | — | — | — | — |
role.update | ✓ | — | — | — | — |
role.delete | ✓ | — | — | — | — |
role.permission.assign | ✓ | — | — | — | — |
| Transactions & analytics | |||||
transaction.read | ✓ | ✓ | ✓ | ✓ | — |
stats.partial.read | ✓ | ✓ | — | — | — |
analytics.read | ✓ | ✓ | — | — | — |
log.read | ✓ | ✓ | — | — | — |
anomaly.manage | ✓ | ✓ | — | — | — |
anomaly.threshold.configure | ✓ | — | — | — | — |
Matrice des permissions (rôles plateforme)
| Permission | administrateur | observateur | support |
|---|---|---|---|
organization.manage | ✓ | ✓ | ✓ |
platform.user.manage | ✓ | — | — |
stats.exhaustive.read | ✓ | ✓ | — |
stats.partial.read | ✓ | ✓ | ✓ |
.read (tous domaines) | ✓ | ✓ | ✓ |
menu.read | ✓ | ✓ | ✓ |
Écritures (create/update/delete/manage) | ✓ | — | — |
remarque
administrateur détient toutes les permissions existantes (assignation globale lors des migrations). observateur et support disposent d'un sous-ensemble en lecture seule ; support reçoit aussi user.manage (héritage).
Ressources
- Permissions — modèle détaillé des wildcards
- Rôles (Admin) — API de gestion des rôles
- Authentification — résolution des permissions au login/refresh