Manage Authorization and Permissions¶

This section documents the actual authorization model currently implemented across:

• bf-manage-web frontend auth and UI permission gating
• bf-manage-core backend authentication and workspace-scoped authorization

End to End Flow¶

sequenceDiagram
  participant User
  participant Web as manage web
  participant Amplify as aws amplify session
  participant Core as manage core
  participant Auth as authenticate and authorise
  participant Domain as api endpoint

  User->>Web: open app and trigger action
  Web->>Amplify: fetch current access token
  Web->>Core: request with bearer token and workspace headers
  Core->>Auth: authenticate token and build principal
  Auth->>Auth: authorise workspace action
  Auth->>Domain: allow endpoint execution
  Domain-->>Web: response payload

Control Layers¶

flowchart TD
  TokenAuth[Token authentication] --> Principal[Principal in request state]
  Principal --> WorkspaceScope[Workspace scoping]
  WorkspaceScope --> RoleCheck[Role and action checks]
  RoleCheck --> EndpointAccess[Endpoint access granted or denied]

  UiRoleGate[Frontend role gating] --> Navigation[Nav and feature visibility]
  UiRoleGate --> ActionButtons[Action button availability]

Important design note¶

Frontend checks are user-experience controls. Backend authorization is the enforcement boundary.