Roles and access
Roles, the partner route allow-list and the partner entry points, read from the code.
The access facts that live in code. What the roles mean and how the checks work: Auth and permissions.
Roles
From APP_ROLES in lib/authz/roles.ts. Roles outside SCOPED_ROLES get no rows from the scope helpers unless they have their own branch (partner: lib/authz/scopes/partner.ts).
| Role | In SCOPED_ROLES |
|---|---|
user | yes |
manager | yes |
admin | yes |
partner | no |
Partner routes
PARTNER_ROUTES in lib/partner-routes.ts, enforced by proxy.ts. A partner may open these paths and everything below them (* is one path segment), plus the dashboard. Every other page redirects to the dashboard and every other API route answers 403.
/api/auth/api/documents/*/file/api/invoices/*/pdf/crm/accounts/crm/contacts/crm/leads/crm/opportunities/crm/orders/crm/tasks/sign-in
Partner entry points
Files that call getSession() or requireAuthenticated() with the partner option set to true. Everywhere else a partner is refused. __tests__/authz/partner-entry-points.test.ts fails when this set changes without review.
actions/crm/account/get-task.tsactions/crm/account/get-tasks.tsactions/crm/accounts/create-account.tsactions/crm/accounts/create-task.tsactions/crm/accounts/get-account-by-id.tsactions/crm/accounts/get-accounts.tsactions/crm/accounts/search-accounts.tsactions/crm/accounts/update-account.tsactions/crm/activities/create-activity.tsactions/crm/activities/get-activities-by-entity.tsactions/crm/activities/update-activity.tsactions/crm/audit-log/get-audit-log-by-entity.tsactions/crm/contacts/create-contact.tsactions/crm/contacts/update-contact.tsactions/crm/get-account.tsactions/crm/get-accounts-by-contactId.tsactions/crm/get-accounts-by-opportunityId.tsactions/crm/get-accounts.tsactions/crm/get-contact.tsactions/crm/get-contacts-by-accountId.tsactions/crm/get-contacts-by-opportunityId.tsactions/crm/get-contacts.tsactions/crm/get-contracts.tsactions/crm/get-crm-data.tsactions/crm/get-lead.tsactions/crm/get-leads-by-accountId.tsactions/crm/get-leads.tsactions/crm/get-opportunities-with-includes-by-accountId.tsactions/crm/get-opportunities-with-includes-by-contactId.tsactions/crm/get-opportunities-with-includes.tsactions/crm/get-opportunity.tsactions/crm/leads/create-lead.tsactions/crm/leads/update-lead.tsactions/crm/opportunities/create-opportunity.tsactions/crm/opportunities/update-opportunity.tsactions/crm/opportunity/get-expected-revenue.tsactions/crm/orders/queries.tsactions/crm/similarity/get-similar-accounts.tsactions/crm/similarity/get-similar-contacts.tsactions/crm/similarity/get-similar-leads.tsactions/crm/similarity/get-similar-opportunities.tsactions/crm/tasks/add-comment.tsactions/dashboard/get-accounts-count.tsactions/dashboard/get-active-users-count.tsactions/dashboard/get-boards-count.tsactions/dashboard/get-campaigns-count.tsactions/dashboard/get-contacts-count.tsactions/dashboard/get-contracts-count.tsactions/dashboard/get-documents-count.tsactions/dashboard/get-invoices-count.tsactions/dashboard/get-leads-count.tsactions/dashboard/get-opportunities-count.tsactions/dashboard/get-targets-count.tsactions/dashboard/get-tasks-count.tsactions/documents/get-document-versions.tsactions/documents/get-documents-by-accountId.tsactions/documents/get-documents-by-contactId.tsactions/documents/get-documents-by-opportunityId.tsactions/documents/get-documents.tsactions/documents/get-storage-size.tsactions/documents/search-documents.tsactions/get-users.tsactions/invoices/get-invoices-by-accountId.tsactions/user/get-user-by-id.tsactions/user/search-users.tsactions/user/set-language.tsapp/[locale]/(routes)/crm/accounts/[accountId]/components/HistoryTab.tsxapp/[locale]/(routes)/crm/accounts/[accountId]/page.tsxapp/[locale]/(routes)/crm/contacts/[contactId]/components/HistoryTab.tsxapp/[locale]/(routes)/crm/leads/[leadId]/components/HistoryTab.tsxapp/[locale]/(routes)/crm/opportunities/[opportunityId]/components/HistoryTab.tsxapp/[locale]/(routes)/crm/orders/[orderId]/page.tsxapp/[locale]/(routes)/page.tsxapp/api/documents/[documentId]/file/route.tsapp/api/invoices/[invoiceId]/pdf/route.ts