Check permissions instead of role names

How to do it

Write one list of permissions, each an action on a kind of record. Write one map from each role to its permissions, in code or in a table. Feature code calls one function, such as can(membership, 'invoice.refund'). A new or changed role is then one edit. An unknown role or permission gets no, as deny by default says. The interface may use the same function to hide buttons, but the server check is what counts.

Example

const ROLE_PERMISSIONS = {
  owner: ['invoice.read', 'invoice.create', 'invoice.refund', 'member.manage', 'billing.manage'],
  admin: ['invoice.read', 'invoice.create', 'invoice.refund', 'member.manage'],
  member: ['invoice.read', 'invoice.create'],
  viewer: ['invoice.read'],
};

export const can = (membership, permission) =>
  ROLE_PERMISSIONS[membership?.role]?.includes(permission) ?? false;

ROLE_PERMISSIONS = {
    "owner": {"invoice.read", "invoice.create", "invoice.refund", "member.manage", "billing.manage"},
    "admin": {"invoice.read", "invoice.create", "invoice.refund", "member.manage"},
    "member": {"invoice.read", "invoice.create"},
    "viewer": {"invoice.read"},
}

def can(membership, permission: str) -> bool:
    return membership is not None and permission in ROLE_PERMISSIONS.get(membership.role, set())

How to check

Search the code for role comparisons, such as role === 'admin' or role == "admin". Matches appear only in the policy module. A test confirms can answers no for an unknown role.