Hierarchy Authorization Guard
Component Detail
Service Layer
medium complexity
backend
1
Dependencies
2
Dependents
1
Entities
0
Integrations
Description
Enforces level-scoped access control for all hierarchy management operations. Ensures that admins can only create, update, or delete organizations within their own descendant scope - a regional admin cannot modify a national-level organization, and sibling organizations remain mutually inaccessible.
hierarchy-authorization-guard
Responsibilities
- Resolve the requesting admin's organizational level and descendant scope from session context
- Validate that the target organization falls within the admin's permitted scope
- Block cross-sibling access to enforce data isolation between peer organizations
- Integrate with the role-based access control system for role-level permission checks
Interfaces
canManageOrganization(adminUserId: string, targetOrgId: string): boolean
getAdminScope(adminUserId: string): OrgScope
assertScopeOrThrow(adminUserId: string, targetOrgId: string): void
isSiblingOrUnrelated(adminOrgId: string, targetOrgId: string): boolean
Relationships
Dependents (2)
Components that depend on this component