Operations¶

RBAC permissions and operations in calServer V2.

Overview¶

calServer V2 uses a role-based access control system (RBAC) with around 130 operations organized into approximately 27 groups. Each operation controls access to a specific API endpoint or UI element.

Concept¶

User --> Role --> Operations --> API Endpoints / UI Elements

Permission concept

Users are assigned roles, which in turn contain operations. Operations control which actions a user is allowed to perform.

Naming convention¶

Operations follow the pattern {module}_view / {module}_edit / {module}_delete. edit covers create and update – there is no separate create. view = read, delete = delete.

Reference catalogs are readable

Lookup/reference data (categories, statuses, test standards, additional fields, and role/group/operation lists) is readable by any user with using_API, because it populates pickers in many forms. Only creating/editing/deleting is protected by a dedicated operation.

Operation groups (excerpt)¶

Inventory¶

Operation	Description
`inventory_view`	View devices
`inventory_edit`	Create/edit devices
`inventory_delete`	Delete devices

Calibration¶

Operation	Description
`calibration_view`	View calibrations
`calibration_edit`	Create/edit calibrations
`calibration_delete`	Delete calibrations

Repair & Contacts¶

Operation	Description
`repair_view` / `repair_edit` / `repair_delete`	View/edit/delete repairs
`contact_view` / `contact_edit` / `contact_delete`	View/edit/delete contacts

Catalogs (reads open, maintenance protected)¶

Operation	Description
`category_edit` / `category_delete`	Maintain/delete categories
`test_standard_edit` / `test_standard_delete`	Maintain/delete test standards
`additional_field_edit` / `additional_field_delete`	Maintain/delete additional fields
`status_view` / `status_edit` / `status_delete`	View/maintain/delete status configuration

Document Management (DMS)¶

Operation	Description
`dms_view`	View documents
`dms_edit`	Upload/edit documents
`dms_delete`	Delete documents
`document_download`	Download documents
`signature_write`	Sign documents
`file_administrator_options`	Approve/administer documents

Users, Roles & Groups¶

Operation	Description
`user_management_view`	View users
`user_management_edit`	Create/edit users
`user_management_delete`	Delete users
`role_edit` / `role_delete`	Manage/delete roles and role groups
`group_edit` / `group_delete`	Manage/delete user groups

Email & Reports¶

Operation	Description
`email_management_view` / `email_management_edit` / `email_management_delete`	View/edit/delete email configuration
`report_management_admin`	Manage reporting

Administration¶

Operation	Description
`basic_setting_admin`	Manage basic settings
`administration_management`	Central administration (cron jobs, updates, cache)
`database_management_admin`	Database management/backups
`data_migration_admin`	Data migration from calServer V1 or MET/TRACK into V2
`language_management`	Manage languages and translations

Full list

The authoritative list of all operations lives in code in app/Console/Commands/AppSetup.php (RBAC_OPERATIONS) with labels in app/Support/OperationCatalog.php, and is fully visible in the role editor under Admin > Users > Operations.

Mapping to API Endpoints¶

Each operation is checked via middleware at the API level:

Route::middleware('api.auth:inventory_view')->group(function (): void {
    Route::get('/inventories', [InventoryController::class, 'index']);
});

Multiple operations (AND-combined) are possible: api.auth:inventory_edit for write routes, api.auth:inventory_delete for delete routes. using_API is mandatory on every authenticated request.

Mapping to UI Elements¶

In the Nuxt 4 frontend, operations are checked via a permission check:

<template>
  <button v-if="can('inventory_edit')">
    New Device
  </button>
</template>

Frontend and backend checks

Permission checks are performed both in the frontend (UI visibility) and in the backend (API access). Both checks are necessary for a secure system.

Managing Operations¶

Operations are shown under Admin > Users > Operations. New operations are created during feature development in AppSetup::RBAC_OPERATIONS + OperationCatalog and rolled out to existing installations via php artisan app:setup.