Security and Authentication - RodrigoMattosoSilveira/EnterpriseRemoteSystems GitHub Wiki

15.1 Recommended approach

• Fiber JWT authentication for API
• Refresh token support optional later
• Password-based login for internal users
• Role-based authorization middleware

15.2 Authorization matrix

Administrator

• full CRUD on everything
• close journey
• zero gold
• revert entries
• manage reference data

Planner

• work periods
• planning
• inform
• accrual
• view collaborator summaries

Mercantile Operator

• create expenses
• view collaborator summaries
• view price list
• cannot close journey or revert accruals

Finance Viewer

• read-only access to balances and reports

15.3 Audit requirements

Audit all:

• login/logout
• journey creation/extension/close
• accrual posting
• expense posting
• reversals
• zero operations
• reference-data changes