Overview

Refactored the authorization architecture from hardcoded role checking (requireRole) to fully dynamic permission-based authorization (requirePermission), where roles contain dynamic permissions and authorization is evaluated strictly against user permissions.

Key Changes

• Dynamic RBAC Middleware: Replaced requireRole with requirePermission across all API route modules (wallets, transactions, transfers, categories, budgets, saving-goals, reports, forecast, simulations, anomalies, subscriptions, query, recurring-transactions, notifications, reminders, ai-assistant, uploads, users, rbac).
• Centralized Constants (src/common/constants/):
  • PERMISSIONS: Centralized dictionary of 55 granular system permissions across 18 resources in permission.constant.ts.
  • SYSTEM_ROLES: Centralized constants (ADMIN, USER, MANAGER) for system bootstrapping and lifecycle protections in system-role.constant.ts.
  • Removed obsolete role.constant.ts and role.middleware.ts.
• System Invariants & Safety:
  • Protected system roles (ADMIN, USER, MANAGER) from physical deletion.
  • Protected the ADMIN role from renaming.
  • Added protection to prevent soft-deleting the last active system administrator.
• Audit Logging: Recorded detailed audit logs for all role and permission assignment mutations.
• Dynamic User Filter: Updated findAllUserSchema to accept dynamic roleName string filter.