Permissions & Roles

Overview

Every user has a global rolethat determines platform-wide privileges. Within each project or program, a user's effective role is computed by combining their global role, their relationship to the resource (e.g. creator), and their explicit membership.

Global Roles

Global roles are assigned at the platform level and apply across all projects and programs.

Project Roles

A user's effective project role is determined by the following priority:

1. Global SUPER_ADMIN or ADMIN → ADMIN
2. Global FELLOW → MAINTAINER
3. Project creator → OWNER
4. Explicit project membership → assigned role
5. No membership → VIEWER (read-only)

Project Action Matrix

Detailed permissions for each action within a project:

Program Roles

Programs use a separate role hierarchy. The effective role is determined by:

1. Global SUPER_ADMIN / ADMIN → full access
2. Global FELLOW → curator-level access
3. Program creator → creator (highest program role)
4. Explicit program membership → assigned role
5. No membership → read-only

Program Action Matrix

Backend Enforcement

All write operations are enforced server-side using tRPC middleware:

• protectedProcedure — Requires authentication. All mutations use this middleware, which rejects unauthenticated requests with a 401 UNAUTHORIZED error and enforces rate limiting (60 mutations/min per user).
• Role checks— After authentication, each mutation verifies the user's role using getUserProjectRole() for projects or program membership queries. Insufficient permissions return a 403 FORBIDDEN error.

Frontend Guards

The frontend enforces permissions at two levels:

• Page-level guards — Settings pages check authentication and role before rendering. Unauthenticated users see a sign-in prompt; insufficient roles see an access denied message.
• Action-level guards — Buttons and forms (edit, delete, create) are conditionally rendered based on isAuthenticated and role checks. For example, the delete button only appears for ADMIN/OWNER roles.

Permission Helper Functions

The codebase provides utility functions in src/lib/permissions.ts: