ZEEHAAK AP / FRAMEWORK
Roles & permissions
A configurable starting point for access control.
Integration boundary. Menu visibility is a UX feature. Production handlers must independently verify authenticated identity, permission and tenant ownership on every request. This demo has no authentication backend.
Role matrix
Configured in config/permissions.php
| Role | dashboard.view | orders.view | orders.create | orders.edit | orders.export | users.view |
|---|---|---|---|---|---|---|
| Super Admin | Allowed | Allowed | Allowed | Allowed | Allowed | Allowed |
| Admin | Allowed | Allowed | Allowed | Allowed | Allowed | Allowed |
| Manager | Allowed | Allowed | Denied | Denied | Allowed | Allowed |
| Staff | Allowed | Allowed | Denied | Denied | Denied | Denied |
| Data Entry | Allowed | Allowed | Allowed | Denied | Denied | Denied |
| Viewer | Allowed | Allowed | Denied | Denied | Denied | Denied |
| Custom | Allowed | Denied | Denied | Denied | Denied | Denied |
Current demo role: Admin
Update demo_role in configuration to verify server-side page and action visibility. Query parameters cannot grant a role.
if (!can('orders.edit')) {
http_response_code(403);
exit;
}
// Then enforce ownership and tenant scope in your backend.