Authorization

Role-based access control implemented in plain code on top of AdonisJS Bouncer — no external RBAC library. Four moving parts:

1. PERMISSIONS — a const catalog of every capability the app understands.
2. ROLES — a const catalog of role slugs, each with a weight used to pick a display role.
3. WithRoles — a mixin composed into User that grants assignRole / hasRole / hasPermission / syncRoles.
4. BasePolicy subclasses — enforce hasPermission(...) at the controller.

On the frontend a typed GlobalPermissions object flows through Inertia's shared props and is consumed via useCan(). Adding a permission is a two-line change (PERMISSIONS const + wherever it's gated); adding a role is a config + seed touch.

Rules