Appearance
Roles & Access Control
EaseLab uses role-based access control (RBAC) at two levels: tenant roles for lab staff and platform roles for SaaS operators.
Tenant-level RBAC
Role types
| Type | Permissions | Notes |
|---|---|---|
| Tenant Admin | All permissions | Assigned to lab owner; cannot be restricted |
| Custom roles | Selected permissions | Created in Admin → Roles |
| System roles | Pre-defined sets | Seeded on tenant provisioning (Receptionist, Technician, etc.) |
Permission model
Permissions follow the pattern module.action:
| Action | Code suffix | Example |
|---|---|---|
| View | .view | invoices.view |
| Create | .create | patients.create |
| Edit | .edit | tests.edit |
| Delete | .delete | invoices.delete |
Legacy .manage codes grant create, edit, and delete for a module.
Permission groups
| Group | Modules (examples) |
|---|---|
| Admin | users, roles, catalog, settings, backups, crm |
| Billing | invoices, referrals, rate_lists, deleted_invoices |
| Patients | patients, samples, results_entry, result_verification, report_delivery |
| Sales | stock, consumption, expenses |
| Finance | ledgers, cash_management, salary_management |
| Report | analytics, top_tests, pending_samples |
| Subscription | subscription (view only) |
| Quick Access | quick.create_invoice, quick.send_sms, quick.verify_results |
Retrieve the full catalog via GET /lab/admin/permissions. Check current user access via GET /lab/admin/access.
API enforcement
Controllers call ITenantAccessService.EnsurePermissionAsync before sensitive operations. Missing permission returns HTTP 403 with You do not have permission to perform this action.
Platform-level RBAC
Platform admins have roles with scoped permissions:
| Platform role | Key permissions |
|---|---|
| SuperAdmin | All platform permissions |
| Admin | Tenants, billing, plans, CRM, backups, impersonation |
| Support | View tenants, impersonate, CRM |
| Billing | View tenants, manage billing |
| Viewer | View tenants only |
Platform permission codes
| Code | Capability |
|---|---|
platform.tenants.view | List and view tenants |
platform.tenants.manage | Create, edit, lock, provision |
platform.tenants.billing | Subscription and payment status |
platform.tenants.impersonate | Sign in as tenant owner |
platform.users.manage | Platform admin users |
platform.plans.manage | Subscription packages |
platform.crm.manage | Platform CRM leads |
platform.backups.manage | Backup settings and restore |
Default system roles
On provisioning, EaseLab seeds roles such as:
| Role | Typical use |
|---|---|
| Receptionist | Patients, invoices, payments |
| Lab Technician | Samples, result entry |
| Pathologist | Result verification, report approval |
| Accountant | Ledgers, expenses, reports |
Customize or add roles in Admin → Roles & Permissions. See Manage Roles.
Tenant Admin policy
Endpoints marked with the TenantAdmin authorization policy require the user to be either:
IsTenantAdmin = true(owner), orIsPlatformAdmin = true(during impersonation)
Some endpoints additionally check specific permission codes.