@jmruthers/pace-core 0.2.4

package/src/rbac/README.md

@@ -0,0 +1,885 @@
+# RBAC (Role-Based Access Control) System
+
+A comprehensive, type-safe RBAC system for PACE Core with organisation context enforcement, caching, and audit logging.
+
+## ⚠️ **IMPORTANT: Setup Required**
+
+**You MUST call `setupRBAC()` before using any RBAC components or hooks.** This is a critical requirement that will cause errors if skipped.
+
+## Features
+
+- **Type-Safe**: Full TypeScript support with strict typing
+- **Organisation Context**: Enforced data isolation between organisations
+- **Event-Based Apps**: Automatic organization resolution from event context
+- **Caching**: 60-second TTL with realtime invalidation
+- **Audit Logging**: Structured audit events for all operations
+- **React Hooks**: Easy-to-use hooks for permission checking
+- **Server Adapters**: Middleware for Next.js and Express
+- **ESLint Rules**: Automated enforcement of RBAC patterns
+- **Security Enhanced**: Input validation, rate limiting, and comprehensive security logging
+
+## 🔒 Security Features
+
+The RBAC system includes comprehensive security measures:
+
+### Input Validation
+- **Permission Format Validation**: Ensures permissions follow the correct `operation:resource` format
+- **UUID Validation**: Validates all UUID inputs to prevent injection attacks
+- **Scope Validation**: Ensures scope objects contain valid data
+- **Input Sanitization**: Removes potentially dangerous characters from inputs
+
+### Security Monitoring
+- **Security Event Logging**: Logs all security-related events with severity levels
+- **Suspicious Activity Detection**: Identifies and logs unusual patterns
+- **Rate Limiting**: Prevents abuse with configurable rate limits
+- **Audit Trail**: Comprehensive audit logging for all RBAC operations
+
+### Database Security
+- **Row-Level Security (RLS)**: Enforced data isolation between organisations
+- **Secure Policies**: Context-aware RLS policies prevent cross-organisation data access
+- **Organisation Context Enforcement**: All database operations require organisation context
+
+### Usage with Security Context
+
+```typescript
+import { isPermitted } from '@jmruthers/pace-core/rbac';
+
+// Basic usage (backward compatible)
+const hasPermission = await isPermitted({
+  userId: 'user-123',
+  scope: { organisationId: 'org-456' },
+  permission: 'manage:events'
+});
+
+// Enhanced usage with security context
+const hasPermissionSecure = await isPermitted({
+  userId: 'user-123',
+  scope: { organisationId: 'org-456' },
+  permission: 'manage:events'
+}, {
+  userId: 'user-123',
+  organisationId: 'org-456',
+  ipAddress: '192.168.1.1',
+  userAgent: 'Mozilla/5.0...',
+  timestamp: new Date()
+});
+```
+
+### Security Context Examples
+
+#### 1. API Route Protection
+
+```typescript
+import { isPermitted } from '@jmruthers/pace-core/rbac';
+
+// Express.js middleware
+app.get('/api/users', async (req, res) => {
+  const userId = req.user.id;
+  const organisationId = req.user.organisationId;
+  
+  // Use security context for API routes
+  const hasAccess = await isPermitted({
+    userId,
+    scope: { organisationId },
+    permission: 'read:users'
+  }, {
+    userId,
+    organisationId,
+    ipAddress: req.ip,
+    userAgent: req.get('User-Agent'),
+    timestamp: new Date()
+  });
+  
+  if (!hasAccess) {
+    return res.status(403).json({ error: 'Access denied' });
+  }
+  
+  // Proceed with data access
+  const users = await getUsers(organisationId);
+  res.json(users);
+});
+```
+
+#### 2. React Component with Security
+
+```typescript
+import { useCan } from '@jmruthers/pace-core/rbac';
+import { useAuth } from '@jmruthers/pace-core';
+
+function UserManagement() {
+  const { user } = useAuth();
+  const { hasPermission, isLoading } = useCan(
+    user.id,
+    { organisationId: user.organisationId },
+    'manage:users',
+    true, // useCache
+    {
+      userId: user.id,
+      organisationId: user.organisationId,
+      ipAddress: 'client-side',
+      userAgent: navigator.userAgent,
+      timestamp: new Date()
+    }
+  );
+  
+  if (isLoading) return <div>Loading...</div>;
+  if (!hasPermission) return <div>Access denied</div>;
+  
+  return <UserList />;
+}
+```
+
+#### 3. Server-Side Validation
+
+```typescript
+import { isPermitted } from '@jmruthers/pace-core/rbac';
+
+// Server-side permission check with comprehensive security
+async function validateUserAccess(userId: string, organisationId: string, action: string, request: Request) {
+  const securityContext = {
+    userId,
+    organisationId,
+    ipAddress: request.ip || 'unknown',
+    userAgent: request.headers.get('User-Agent') || 'unknown',
+    timestamp: new Date()
+  };
+  
+  const hasAccess = await isPermitted({
+    userId,
+    scope: { organisationId },
+    permission: action
+  }, securityContext);
+  
+  if (!hasAccess) {
+    // Security event is automatically logged by the RBAC system
+    console.warn(`Access denied for user ${userId} to ${action} in org ${organisationId}`);
+  }
+  
+  return hasAccess;
+}
+```
+
+#### 4. Batch Permission Checks
+
+```typescript
+import { useMultiplePermissions } from '@jmruthers/pace-core/rbac';
+
+function AdminDashboard() {
+  const { user } = useAuth();
+  const { permissions, isLoading } = useMultiplePermissions(
+    user.id,
+    { organisationId: user.organisationId },
+    [
+      'read:users',
+      'create:events',
+      'manage:organisations',
+      'delete:data'
+    ],
+    {
+      userId: user.id,
+      organisationId: user.organisationId,
+      ipAddress: 'client-side',
+      userAgent: navigator.userAgent,
+      timestamp: new Date()
+    }
+  );
+  
+  if (isLoading) return <div>Loading permissions...</div>;
+  
+  return (
+    <div>
+      {permissions['read:users'] && <UserManagement />}
+      {permissions['create:events'] && <EventCreation />}
+      {permissions['manage:organisations'] && <OrganisationSettings />}
+    </div>
+  );
+}
+```
+
+## Quick Start
+
+### 1. **REQUIRED: Complete Setup**
+
+```tsx
+// App.tsx - COMPLETE setup (copy this exactly)
+import React from 'react';
+import { setupRBAC } from '@jmruthers/pace-core/rbac';
+import { UnifiedAuthProvider, OrganisationProvider } from '@jmruthers/pace-core';
+import { createClient } from '@supabase/supabase-js';
+
+// Initialize Supabase
+const supabase = createClient(
+  process.env.REACT_APP_SUPABASE_URL!,
+  process.env.REACT_APP_SUPABASE_ANON_KEY!
+);
+
+// ⚠️ REQUIRED: Setup RBAC first
+setupRBAC(supabase);
+
+function App() {
+  return (
+    <UnifiedAuthProvider supabaseClient={supabase} appName="My App">
+      <OrganisationProvider>
+        <YourAppContent />
+      </OrganisationProvider>
+    </UnifiedAuthProvider>
+  );
+}
+
+export default App;
+```
+
+### 2. **Choose Your Pattern**
+
+#### Pattern 1: PermissionEnforcer (Recommended)
+**Use when**: Protecting pages or large components
+**Benefits**: Automatic scope resolution, no manual context handling
+
+```tsx
+import { PermissionEnforcer } from '@jmruthers/pace-core/rbac';
+
+function Dashboard() {
+  return (
+    <div>
+      <h1>Dashboard</h1>
+      
+      {/* Automatic scope resolution - no manual context needed */}
+      <PermissionEnforcer
+        permissions={['read:admin']}
+        operation="admin-panel"
+        fallback={<div>Access Denied</div>}
+      >
+        <AdminPanel />
+      </PermissionEnforcer>
+    </div>
+  );
+}
+```
+
+#### Pattern 2: usePermissions (For Data Fetching)
+**Use when**: You need the actual permission data for custom logic
+**Requirements**: Must provide explicit scope
+
+```tsx
+import { usePermissions } from '@jmruthers/pace-core/rbac';
+import { useUnifiedAuth } from '@jmruthers/pace-core/providers';
+
+function UserActions() {
+  const { user, selectedOrganisationId } = useUnifiedAuth();
+  
+  // Explicit scope required for usePermissions
+  const { permissions, isLoading, error } = usePermissions(
+    user?.id || '',
+    { 
+      organisationId: selectedOrganisationId || '',
+      eventId: undefined,
+      appId: undefined
+    }
+  );
+
+  if (isLoading) return <div>Loading permissions...</div>;
+  if (error) return <div>Error: {error.message}</div>;
+
+  return (
+    <div>
+      {permissions['page-1']?.includes('read') && <ReadButton />}
+      {permissions['page-1']?.includes('manage') && <ManageButton />}
+    </div>
+  );
+}
+```
+
+#### Pattern 3: useCan (For Individual Checks)
+**Use when**: Checking specific permissions with loading states
+**Requirements**: Must provide explicit scope
+
+```tsx
+import { useCan } from '@jmruthers/pace-core/rbac';
+import { useUnifiedAuth } from '@jmruthers/pace-core/providers';
+
+function UserActions() {
+  const { user, selectedOrganisationId } = useUnifiedAuth();
+  
+  // Explicit scope required for useCan
+  const { can, isLoading, error } = useCan(
+    user?.id || '',
+    { 
+      organisationId: selectedOrganisationId || '',
+      eventId: undefined,
+      appId: undefined
+    },
+    'manage:users',
+    'page-123' // optional pageId
+  );
+
+  if (isLoading) return <div>Checking permission...</div>;
+  if (error) return <div>Error: {error.message}</div>;
+
+  return (
+    <div>
+      {can ? <AdminPanel /> : <AccessDenied />}
+    </div>
+  );
+}
+```
+
+### 5. Event-Based Apps
+
+For event-based apps, the system automatically resolves organization context from the event:
+
+```tsx
+import { PermissionEnforcer, PagePermissionGuard } from '@jmruthers/pace-core/rbac';
+
+function EventDashboard() {
+  return (
+    <div>
+      <h1>Event Dashboard</h1>
+      
+      {/* Organization is automatically resolved from event context */}
+      <PermissionEnforcer
+        permissions={['read:events']}
+        operation="dashboard"
+      >
+        <EventContent />
+      </PermissionEnforcer>
+      
+      <PagePermissionGuard
+        pageName="settings"
+        operation="read"
+      >
+        <EventSettings />
+      </PagePermissionGuard>
+    </div>
+  );
+}
+```
+
+## 🚨 **Troubleshooting Common Errors**
+
+### Error: "can't access property 'organisationId', scope is undefined"
+
+**Cause**: Missing organisation context or incorrect provider setup
+
+**Solution**:
+1. **Ensure OrganisationProvider wraps your app**:
+   ```tsx
+   <UnifiedAuthProvider supabaseClient={supabase} appName="My App">
+     <OrganisationProvider>  {/* ← This is required! */}
+       <YourAppContent />
+     </OrganisationProvider>
+   </UnifiedAuthProvider>
+   ```
+
+2. **Use PermissionEnforcer for automatic scope resolution**:
+   ```tsx
+   // ✅ Good - automatic scope resolution
+   <PermissionEnforcer permissions={['read:events']}>
+     <EventContent />
+   </PermissionEnforcer>
+   
+   // ❌ Avoid - manual scope handling with usePermissions
+   const { permissions } = usePermissions(userId, scope); // scope might be undefined
+   ```
+
+3. **Check that user has selected an organisation**:
+   ```tsx
+   const { selectedOrganisationId } = useUnifiedAuth();
+   if (!selectedOrganisationId) {
+     return <div>Please select an organisation first</div>;
+   }
+   ```
+
+### Error: "RBACNotInitializedError"
+
+**Cause**: Forgot to call `setupRBAC()`
+
+**Solution**:
+```tsx
+import { setupRBAC } from '@jmruthers/pace-core/rbac';
+
+// ⚠️ REQUIRED: Call this before using any RBAC features
+setupRBAC(supabase);
+```
+
+### Error: "Organisation context is required but not available"
+
+**Cause**: OrganisationProvider not wrapping your app or user not in any organisation
+
+**Solution**:
+1. Ensure OrganisationProvider wraps your app
+2. Check that user has organisation memberships in the database
+3. Verify user has selected an organisation
+
+## 🎯 **When to Use What Pattern**
+
+### Use PermissionEnforcer when:
+- Protecting entire pages or large components
+- You want automatic scope resolution
+- You need fallback UI for denied access
+
+### Use usePermissions when:
+- You need the actual permission data
+- You're building custom permission logic
+- You need loading states and error handling
+
+### Use useCan when:
+- Checking individual permissions
+- You need real-time permission checking
+- You're building dynamic UI based on permissions
+
+## Documentation
+
+- **[Getting Started Guide](./docs/rbac/getting-started.md)** - Complete setup guide
+- **[API Reference](./docs/rbac/api-reference.md)** - Full API documentation
+- **[Examples](./docs/rbac/examples.md)** - Real-world examples
+- **[Event-Based Apps](./docs/event-based-apps.md)** - Guide for event-based applications
+- **[Troubleshooting](./docs/rbac/troubleshooting.md)** - Common issues and solutions
+- **[Migration Guide](./docs/migration/rbac-migration.md)** - Migrating from legacy RBAC
+
+## Quick Reference
+
+### Core Functions
+
+```typescript
+import { isPermitted, getAccessLevel, getPermissionMap } from '@jmruthers/pace-core/rbac';
+
+// Check if user has permission
+const canManage = await isPermitted({
+  userId: 'user-123',
+  scope: { organisationId: 'org-456' },
+  permission: 'manage:events',
+  pageId: 'page-789'
+});
+
+// Get user's access level
+const accessLevel = await getAccessLevel({
+  userId: 'user-123',
+  scope: { organisationId: 'org-456' }
+});
+
+// Get permission map for all pages
+const permissions = await getPermissionMap({
+  userId: 'user-123',
+  scope: { 
+    organisationId: 'org-456',
+    eventId: 'event-789',
+    appId: 'app-101'
+  }
+});
+```
+
+### 3. React Hooks
+
+```tsx
+import { usePermissions, useCan, useAccessLevel } from '@jmruthers/pace-core/rbac';
+
+function MyComponent() {
+  const { permissions, isLoading, error } = usePermissions(
+    'user-123',
+    { organisationId: 'org-456' }
+  );
+
+  const { can, isLoading: checking } = useCan(
+    'user-123',
+    { organisationId: 'org-456' },
+    'manage:events'
+  );
+
+  const { accessLevel } = useAccessLevel(
+    'user-123',
+    { organisationId: 'org-456' }
+  );
+
+  if (isLoading) return <div>Loading...</div>;
+  if (error) return <div>Error: {error.message}</div>;
+
+  return (
+    <div>
+      {can && <AdminPanel />}
+      {accessLevel === 'admin' && <AdminControls />}
+    </div>
+  );
+}
+```
+
+### 4. Permission Guards
+
+```tsx
+import { PermissionEnforcer, PagePermissionGuard } from '@jmruthers/pace-core/rbac';
+
+function App() {
+  return (
+    <div>
+      <PermissionEnforcer
+        permissions={['manage:events']}
+        operation="event-management"
+        fallback={<AccessDenied />}
+      >
+        <EventManagement />
+      </PermissionEnforcer>
+
+      <PagePermissionGuard
+        pageName="admin"
+        operation="read"
+        fallback={<AccessDenied />}
+      >
+        <AdminPanel />
+      </PagePermissionGuard>
+    </div>
+  );
+}
+```
+
+### 5. Server Middleware
+
+```typescript
+import { withPermissionGuard, withAccessLevelGuard } from '@jmruthers/pace-core/rbac';
+
+// Express middleware
+app.get('/admin', 
+  withPermissionGuard({ permission: 'manage:admin' }, 
+    (req, res) => {
+      res.json({ message: 'Admin access granted' });
+    }
+  )
+);
+
+// Access level guard
+app.get('/admin/users',
+  withAccessLevelGuard('admin',
+    (req, res) => {
+      res.json({ users: [] });
+    }
+  )
+);
+```
+
+## API Reference
+
+### Core Functions
+
+#### `isPermitted(input: PermissionCheck): Promise<boolean>`
+
+Check if a user has a specific permission.
+
+```typescript
+const hasPermission = await isPermitted({
+  userId: 'user-123',
+  scope: { organisationId: 'org-456' },
+  permission: 'manage:events',
+  pageId: 'page-789'
+});
+```
+
+#### `getAccessLevel(input: { userId: UUID; scope: Scope }): Promise<AccessLevel>`
+
+Get user's access level in a scope.
+
+```typescript
+const accessLevel = await getAccessLevel({
+  userId: 'user-123',
+  scope: { organisationId: 'org-456' }
+});
+// Returns: 'viewer' | 'participant' | 'planner' | 'admin' | 'super'
+```
+
+#### `getPermissionMap(input: { userId: UUID; scope: Scope }): Promise<PermissionMap>`
+
+Get user's permission map for all pages in a scope.
+
+```typescript
+const permissions = await getPermissionMap({
+  userId: 'user-123',
+  scope: { organisationId: 'org-456', appId: 'app-789' }
+});
+// Returns: { [pageId]: Operation[] }
+```
+
+### React Hooks
+
+#### `usePermissions(userId: UUID, scope: Scope): UsePermissionsReturn`
+
+Hook to get user's permissions in a scope.
+
+```typescript
+const { permissions, isLoading, error, refetch } = usePermissions(
+  'user-123',
+  { organisationId: 'org-456' }
+);
+```
+
+#### `useCan(userId: UUID, scope: Scope, permission: Permission, pageId?: UUID): UseCanReturn`
+
+Hook to check if user has a specific permission.
+
+```typescript
+const { can, isLoading, error, check } = useCan(
+  'user-123',
+  { organisationId: 'org-456' },
+  'manage:events',
+  'page-789'
+);
+```
+
+#### `useAccessLevel(userId: UUID, scope: Scope): { accessLevel: AccessLevel | null; isLoading: boolean; error: Error | null; refetch: () => Promise<void> }`
+
+Hook to get user's access level in a scope.
+
+```typescript
+const { accessLevel, isLoading, error, refetch } = useAccessLevel(
+  'user-123',
+  { organisationId: 'org-456' }
+);
+```
+
+### Components
+
+#### `PermissionEnforcer`
+
+Conditionally renders children based on permissions. Works for both organization-based and event-based apps.
+
+```tsx
+<PermissionEnforcer
+  permissions={['manage:events']}
+  operation="event-management"
+  fallback={<AccessDenied />}
+  onDenied={() => console.log('Access denied')}
+>
+  <AdminPanel />
+</PermissionEnforcer>
+```
+
+#### `PagePermissionGuard`
+
+Conditionally renders children based on page-level permissions.
+
+```tsx
+<PagePermissionGuard
+  pageName="admin"
+  operation="read"
+  fallback={<AccessDenied />}
+>
+  <AdminPanel />
+</PagePermissionGuard>
+```
+
+#### `NavigationGuard`
+
+Conditionally renders navigation items based on permissions.
+
+```tsx
+<NavigationGuard
+  navigationItem={navItem}
+  fallback={<DisabledNavItem />}
+>
+  <NavLink />
+</NavigationGuard>
+```
+
+### Server Adapters
+
+#### `withPermissionGuard(config, handler)`
+
+Wraps a server handler with permission checking.
+
+```typescript
+const protectedHandler = withPermissionGuard(
+  { permission: 'manage:events', pageId: 'page-789' },
+  async (req, res) => {
+    // Handler logic here
+    res.json({ success: true });
+  }
+);
+```
+
+#### `withAccessLevelGuard(minLevel, handler)`
+
+Wraps a server handler with access level checking.
+
+```typescript
+const adminHandler = withAccessLevelGuard(
+  'admin',
+  async (req, res) => {
+    // Admin-only logic here
+    res.json({ success: true });
+  }
+);
+```
+
+## Types
+
+### Core Types
+
+```typescript
+type Operation = 'read' | 'create' | 'update' | 'delete' | 'manage';
+type Permission = `${Operation}:${string}`;
+type AccessLevel = 'viewer' | 'participant' | 'planner' | 'admin' | 'super';
+
+interface Scope {
+  organisationId?: UUID;
+  eventId?: string;
+  appId?: UUID;
+}
+
+interface PermissionCheck {
+  userId: UUID;
+  scope: Scope;
+  permission: Permission;
+  pageId?: UUID;
+}
+```
+
+### Role Types
+
+```typescript
+type GlobalRole = 'super_admin';
+type OrganisationRole = 'supporter' | 'member' | 'leader' | 'org_admin';
+type EventAppRole = 'viewer' | 'participant' | 'planner' | 'event_admin';
+```
+
+## Permission Algorithm
+
+The RBAC system uses a deny-overrides-allow precedence model:
+
+1. **Super Admin Check**: If user has `super_admin` role → allow (log bypass:true)
+2. **Collect Active Grants**: Gather grants at page → eventApp → organisation → global
+3. **Apply Explicit Denies**: Check for explicit denies at closest scope first
+4. **Merge Allows**: If no deny, merge allows outward to wider scopes
+5. **Page Rule Refinements**: Apply page-level deny overrides
+6. **Return Decision**: Emit audit event with final decision
+
+## Caching
+
+The system includes intelligent caching with:
+
+- **60-second TTL** for permission results
+- **Realtime invalidation** when roles change
+- **Pattern-based invalidation** for related permissions
+- **Cache statistics** for monitoring
+
+```typescript
+import { rbacCache, CACHE_PATTERNS } from '@jmruthers/pace-core/rbac';
+
+// Invalidate user's cache
+rbacCache.invalidate(CACHE_PATTERNS.USER('user-123'));
+
+// Invalidate organisation's cache
+rbacCache.invalidate(CACHE_PATTERNS.ORGANISATION('org-456'));
+
+// Clear all cache
+rbacCache.clear();
+```
+
+## Audit Logging
+
+All permission checks are logged with structured audit events:
+
+```typescript
+interface RBACAuditEvent {
+  id: UUID;
+  event_type: 'permission_check' | 'permission_denied' | 'role_granted' | 'role_denied' | 'rls_denied';
+  user_id: UUID;
+  organisation_id: UUID;
+  event_id?: string;
+  app_id?: UUID;
+  page_id?: UUID;
+  permission?: string;
+  decision?: boolean;
+  source?: 'api' | 'ui' | 'middleware' | 'rls';
+  bypass?: boolean;
+  duration_ms?: number;
+  metadata: Record<string, any>;
+  created_at: string;
+}
+```
+
+## ESLint Rules
+
+The package includes ESLint rules to enforce RBAC patterns:
+
+```javascript
+// .eslintrc.js
+module.exports = {
+  extends: ['@jmruthers/pace-core/rbac/eslint-rules'],
+  rules: {
+    'no-direct-supabase-import': 'error',
+    'require-permission-guard': 'error',
+    'forbid-inline-permissions': 'error',
+    'require-organisation-context': 'error',
+    'require-rbac-error-handling': 'warn',
+    'require-rbac-loading-states': 'warn',
+  }
+};
+```
+
+## Testing
+
+The package includes comprehensive tests:
+
+- **Unit Tests**: Individual function testing
+- **Integration Tests**: End-to-end testing with real database
+- **Property-based Tests**: Automated testing of invariants
+- **Contract Tests**: API contract validation
+
+```bash
+# Run tests
+npm test
+
+# Run with coverage
+npm run test:coverage
+
+# Run integration tests
+npm run test:integration
+```
+
+## Migration Guide
+
+### From Old RBAC System
+
+1. **Update Imports**: Replace old imports with new ones
+2. **Update Types**: Use new type definitions
+3. **Add Organisation Context**: Ensure all operations include organisation context
+4. **Update Hooks**: Use new hook signatures
+5. **Add Error Handling**: Implement proper error handling
+6. **Add Loading States**: Add loading state management
+
+### Breaking Changes
+
+- **No Backward Compatibility**: Old system is completely replaced
+- **Organisation Context Required**: All operations must include organisation context
+- **New Type System**: Types are more strict and comprehensive
+- **New Hook Signatures**: Hooks have different parameters and return values
+
+## Troubleshooting
+
+### Common Issues
+
+1. **Organisation Context Missing**: Ensure all operations include `organisationId`
+2. **Permission Denied**: Check user's roles and permissions
+3. **Cache Issues**: Clear cache or check invalidation patterns
+4. **Type Errors**: Ensure all types are properly imported and used
+
+### Debug Mode
+
+Enable debug mode for detailed logging:
+
+```typescript
+import { setGlobalAuditManager } from '@jmruthers/pace-core/rbac';
+
+// Enable debug logging
+const auditManager = createAuditManager(supabase);
+auditManager.setEnabled(true);
+setGlobalAuditManager(auditManager);
+```
+
+## Contributing
+
+1. Follow the existing code style
+2. Add tests for new features
+3. Update documentation
+4. Ensure all tests pass
+5. Follow the RBAC patterns
+
+## License
+
+MIT License - see LICENSE file for details.