Implementing Role-Based Access Control (RBAC)

CREATE TABLE roles (id SERIAL PRIMARY KEY, name TEXT UNIQUE);
CREATE TABLE permissions (id SERIAL PRIMARY KEY, name TEXT UNIQUE);
CREATE TABLE role_permissions (
  role_id INT REFERENCES roles, permission_id INT REFERENCES permissions,
  PRIMARY KEY (role_id, permission_id)
);
CREATE TABLE user_roles (
  user_id BIGINT, role_id INT, granted_at TIMESTAMPTZ, granted_by BIGINT,
  PRIMARY KEY (user_id, role_id)
);

@PreAuthorize("hasAuthority('orders:write')")
public Order create(...) { ... }

// Or programmatic
if (!authService.hasPermission(user, "orders", "write", orderId))
  throw new AccessDeniedException();

function Can({ permission, children }) {
  const { permissions } = useAuth();
  return permissions.includes(permission) ? children : null;
}

<Can permission="orders:delete">
  <DeleteButton />
</Can>