Skip to main content

Asset UI Permissions and Visibility

Summary​

Asset UI access is governed by navigation visibility rules and route guards driven by module features, permissions, and roles. These are frontend visibility and feature gates only. Critically, they are not backend authorization: the asset compatibility endpoints are tenant-scoped but not role-authorized.

Audience​

  • Developers configuring nav and guards.
  • QA engineers validating visibility per role.
  • Support engineers explaining access behaviour.
  • Security engineers assessing enforcement boundaries.

Reference Content​

Nav itemPathGroupPermissionsRolesAudience
asset-requests (Assets)/hr-operations/assetsWorkforce["hr-operations"]["hr-admin","it-asset-admin"]admin/manager
ess-assets (Assets)/assetsSelf Service["Asset.ViewSelf","hr-operations"]n/aemployee

The admin item uses moduleFeature "hr-operations" and icon ClipboardList. An it-asset-admin role exists and also appears on the Operations Dashboard nav item.

Route guards​

ProtectedRoute uses a longest-prefix match over routeFeatures. The /hr-operations prefix rule requires moduleFeature hr-operations AND one of its permissions (which include hr-operations); /hr-operations/assets is governed by this rule. /assets has no routeFeatures entry and is therefore authenticated-only at the route level, with navigation visibility gated by Asset.ViewSelf. Super-admin roles are redirected out.

moduleFeature and permission gates​

The admin route requires both the module feature and a matching permission. The ESS route relies on authentication plus a navigation-level permission gate rather than a route-level feature rule.

Roles​

Roles referenced include hr-admin and it-asset-admin for admin asset access. Employee access is audience-based with the Asset.ViewSelf permission gating navigation.

Critical enforcement point​

Frontend visibility is not backend authorization. The asset compatibility endpoints are tenant-scoped but not role-authorized at the backend (anonymous-by-design private mesh). A client that reaches those endpoints is constrained by tenant scope, not by the frontend role/permission gates. Backend authorization for asset actions should be classified as Requires confirmation and must not be assumed from UI gating.

Source References​

  • UI/salary-ui/apps/client-hrms-portal/src/components/AppLayout.tsx
  • UI/salary-ui/apps/client-hrms-portal/src/utils/ProtectedRoute.tsx
  • microservices/src/asset-service/Api/AssetCompatEndpoints.cs

See Also​

Keywords​

permissions, visibility, route guard, module feature, tenant scope

Revision Information​

  • Status: Draft
  • Last reviewed: 2026-07-17
  • Review cycle: Quarterly