Server RBAC enforcement
US-2.2 matrix must be enforced on the server — UI persona switch is not authorization
Hiding nav items is not security. Live JWT role middleware and matrix tests remain Blocked until the server layer lands.
Checks
5
Enforcement gates
Server stub
1
Marked ready
UI only
3
Not authz
Missing
1
Need build
Enforcement checklist
| Item | Status | Link |
|---|---|---|
Role claims on JWT / session Server reads role from verified token — not from localStorage alone. | UI only (not authz) | /access |
requireSupabaseAuth + role middleware All /api/* handlers use withApiAuth (Bearer JWT). Role-claim matrix on handlers still pending (E29). | Server stub ready | — |
US-2.2 matrix tests per role×module Automated cases for full/view/none on registration/OPD/IPD/pharmacy/billing/admin. | UI only (not authz) | /access |
UI hide ≠ authorization Direct URL / API still denied when nav hides a module. | UI only (not authz) | — |
Denied attempts audited 403s for PHI routes write audit with actor + path. | Missing | /audit |
PRD matrix snapshot (allowed modules)
- Front-desk — registration, opd, ipd, billing
- Doctor — registration, opd, ipd, pharmacy
- Nurse — registration, opd, ipd, pharmacy
- Pharmacist — opd, pharmacy, billing
- Billing — registration, opd, ipd, pharmacy, billing
- Facility admin — registration, opd, ipd, pharmacy, billing, admin
- Chain admin — registration, opd, ipd, pharmacy, billing, admin
- Platform admin — registration, opd, ipd, pharmacy, billing, admin