Advanced Room Permissions & Role-Based Access Control (RBAC)

[bchou9]

Feature Description

Implement granular role-based access control (RBAC) for rooms with customizable permissions beyond the current owner/editor/viewer model.

Current Limitation

Currently, ResCanvas has basic room roles (owner, editor, viewer) but lacks fine-grained permission controls for specific actions like:

• Stroke deletion/modification by others
• Room settings modification
• Member invitation/removal
• Canvas clearing
• Undo/redo of others' actions

Proposed Enhancement

New Permission System:

• can_draw - Create new strokes
• can_edit_own - Edit/undo own strokes
• can_edit_others - Edit/undo others' strokes
• can_delete - Delete any stroke
• can_clear_canvas - Clear entire canvas
• can_invite - Invite new members
• can_manage_members - Change member roles
• can_configure_room - Modify room settings
• can_export - Export canvas data

Custom Role Templates:

• Moderator: can manage members + delete content
• Contributor: can draw + edit own
• Reviewer: view-only + can comment
• Admin: all permissions

Implementation Areas

• backend/routes/rooms.py - Add permission checks to all room operations
• backend/middleware/auth.py - Extend require_room_access with permission validation
• frontend/src/pages/RoomSettings.jsx - UI for managing custom roles
• MongoDB schema update for rooms collection with permission matrix
• API endpoints: PUT /rooms/{id}/roles, GET /rooms/{id}/permissions

Benefits

• Educational institutions can create student/teacher roles
• Teams can enforce review workflows
• Public rooms can have moderators
• Better control over collaborative sessions

Testing Considerations

• Unit tests for permission validation logic
• Integration tests for role inheritance
• E2E tests for UI permission changes

Related Files

• backend/routes/rooms.py
• backend/middleware/auth.py
• frontend/src/pages/RoomSettings.jsx
• frontend/src/api/rooms.js

[HarjobandeepSingh]

@bchou9 i would like to work on this issue

[bchou9]

Hi @HarjobandeepSingh , issue assigned. Thanks for the help!