RBAC API
Manage roles and permissions: list, add, edit, and assign roles to users (e.g. staff) or permissions to roles. All routes require Authorization: Bearer <access_token> and admin role. Base path: <API_BASE_URL>/rbac.
Roles
List all roles with their permissions. Response: {"roles": [{"id", "name", "description", "permissions": [{"id", "name"}]}]}.
Create a role. Body: name (required), description (optional). Returns the created role with permissions array. 409 if name already exists.
Get one role with full permissions list. 404 if not found.
Update a role. Body: optional name, description. Returns updated role. 409 if new name already exists.
Assign role to a user (e.g. assign staff role to a user). Body: {"user_id": number}. Returns {"message": "Role assigned", "user_id": number}. 404 if user or role not found.
Remove role from user. 404 if user/role not found or user does not have the role.
Assign permission to role. Body: {"permission_id": number}. 404 if role or permission not found.
Remove permission from role. 404 if role/permission not found or role does not have the permission.
Permissions
List all permissions with their roles. Response: {"permissions": [{"id", "name", "description", "roles": [{"id", "name"}]}]}.
Create a permission. Body: name (required), description (optional). Returns the created permission with roles array. 409 if name already exists.
Get one permission with full roles list. 404 if not found.
Update a permission. Body: optional name, description. Returns updated permission. 409 if new name already exists.
Common responses
401 if missing or invalid token. 403 if not admin. 404 if resource not found. 409 if name already exists (role or permission).