alla-allaos-fullstack/docs/implementation/task-l-crm-permission-role-management.md

Task L: CRM Permission & Role Management

Summary

Task L starts the production CRM authorization foundation by replacing template-level behavior with organization-owned role profiles, effective permission resolution, and server-side scope enforcement.

Implemented

• Added CRM role profile defaults for:
  • marketing
  • sales
  • sales_support
  • sales_manager
  • department_manager
  • top_manager
  • crm_admin
• Added dedicated CRM permissions for:
  • quotation pricing visibility
  • role management
  • master option management
• Added crmRoleProfiles persistence model with:
  • permissions
  • ownership scope
  • branch scope mode
  • product scope mode
  • approval authority
  • active/system flags
• Added membership scope fields:
  • branchScopeIds
  • productTypeScopeIds
• Added resolved CRM access helper to combine:
  • system role
  • membership role
  • role profile permissions
  • direct membership permissions
• Added CRM Settings > Roles page and role-management APIs for:
  • role listing
  • role editing
  • permission matrix
  • role cloning
  • role activation/deactivation
• Added audit logging for CRM role create/update events.
• Moved CRM dashboard access evaluation to resolved branch/product/ownership scope.
• Started server-side enquiry enforcement for:
  • branch scope
  • product-type scope
  • ownership visibility
  • assign/reassign/follow-up access consistency

Notes

• This task lays the authorization foundation first; dynamic user assignment UI for cloned CRM roles can build on top of these role profiles next.
• Quotation and approval flows should continue migrating onto the same resolved access model so ownership and scope rules stay consistent across CRM.

Verification

• Run: npx tsc --noEmit
• Confirm CRM Settings sidebar shows Roles & Permissions only for users with crm.role.read
• Confirm sales users cannot access enquiries outside assigned branch/product scope
• Confirm dashboard export and dashboard summary honor resolved scope and permissions