The boilerplate includes a hierarchical role system where higher roles inherit permissions from lower roles, providing flexible and scalable access control.
Perfect for: Team management, progressive access levels, and enterprise role structures.
The boilerplate includes a hierarchical role system where higher roles inherit permissions from lower roles:
SUPER_ADMIN ← Highest level (all permissions)
↑
ADMIN ← Admin panel access
↑
REDACTOR ← Content management
↑
MODERATOR ← Community management
↑
USER ← Basic authenticated user
↑
GUEST ← Unauthenticated user
Role inheritance: A MODERATOR automatically has all USER permissions, an ADMIN has all MODERATOR + USER permissions, etc.
Unauthenticated users
Permissions:
Cannot: Access any protected features
// Admin function to assign roles
export async function assignRole(userId: string, newRole: Role) {
// Verify current user has permission to assign roles
const currentUser = await getCurrentUser()
const ability = await definePermissions(currentUser)
if (!ability.can('manage', 'User')) {
throw new Error('Insufficient permissions to assign roles')
}
// Update user role
await updateUserRole(userId, newRole)
// Log role change for audit
await logRoleChange({
userId,
oldRole: user.role,
newRole,
assignedBy: currentUser.id
})
}// Ensure role hierarchy is respected
export function canAssignRole(assignerRole: Role, targetRole: Role): boolean {
const roleHierarchy = {
'GUEST': 0,
'USER': 1,
'MODERATOR': 2,
'REDACTOR': 3,
'ADMIN': 4,
'SUPER_ADMIN': 5
}
const assignerLevel = roleHierarchy[assignerRole]
const targetLevel = roleHierarchy[targetRole]
// Can only assign roles lower than or equal to your own
return assignerLevel >= targetLevel
}Typical use cases for each role:
GUEST (Public Users):
USER (Customers):
MODERATOR (Community Managers):
REDACTOR (Content Creators):
ADMIN (System Administrators):
SUPER_ADMIN (System Owners):
Begin with USER and ADMIN, add others as needed.
Keep clear documentation of what each role can do.
Review and update user roles periodically.
Give users the minimum role needed for their tasks.
Role system ready! Your application now has a clear, hierarchical role structure that scales with your business needs.