Dhuel FisherProducts / interfaces / systems
Menu
All work

Professional work / AssetWorks LLC / 2026

A permission system customers can configure

Replaced hard-coded profile checks with a role-based permission system, so customer administrators can grant exactly the access their teams need.

Delivered; all 39 spec tasks complete (August 2026)

23
permission keys in a hierarchical registry
39 / 39
spec tasks delivered, including security hardening
4
profile tiers covered by end-to-end tests
80+
unit, integration, and property-based test cases added

The problem

Access was decided by checking profile names in code. A customer wanted a "user manager" who could manage users and assign work but not touch system settings. With name checks, every request like that needed a developer.

My role

Designed and delivered the permission system end to end, across the product and the shared backend: schema, API, UI, security hardening, and tests.

  1. Registry
    • 23 keys
    • Hierarchical categories
    • Per-profile grants
  2. Server
    • Route guards
    • Filtered navigation
    • Escalation guards
  3. Interface
    • Page gates
    • Permission-aware controls
    • Readable access-denied page
  4. Proof
    • Unit and integration tests
    • End-to-end tests per tier
    • Property-based test
Where a permission is enforced. The same key is checked at every layer, so hiding a menu item is never the only protection.

What I did

  1. Map every existing check

    Traced every profile-name guard across the frontend and backend to build an evidence-based permission matrix. I mapped 14 route files and the affected pages to specific permission keys, and found that the database already stored permissions the product was ignoring.

  2. Design a registry, not a list of rules

    Built a registry of 23 permission keys in hierarchical categories, with navigation filtered on the server, page and route guards, and protection against reaching restricted pages by typing the URL. I kept permissions as simple on/off keys where the product really is binary, and left more granular controls for an app whose domain needs them.

  3. Close the escalation paths

    Audited the design for privilege escalation, then added backend immutability for the developer profile, name reservation, limits on who can grant platform-admin access, and assignment guards.

  4. Make the admin screens usable

    Built profile management with a permission grid, bulk select, collapsible categories, dependency hints, and readable names on the access-denied page instead of raw keys.

Stack

  • TypeScript
  • Next.js
  • React
  • Fastify
  • PostgreSQL (JSONB)
  • Vitest
  • Playwright
  • fast-check