Try five live demosdemo.gravixar.com
Gravixar

Module library

Roles and permissions

Four access levels, from staff up to admin, plus a super-admin above them. Checks run through the same few helpers, so when someone is blocked it fails loudly and the same way everywhere.

Who can see and change what should be a one-line check on every page, and in most codebases I inherit it is not. Here it is. A new role slots in without breaking the old ones, and a blocked request always fails the same clear way.

Under the hood

The pattern I ship is a four-rung role ladder (STAFF < TEAM_LEAD < MANAGER < ADMIN) plus an orthogonal isSuperAdmin tier, plus a small set of guard helpers: requireAuth, requireRole, requireSuperAdmin, guardSuperAdminTarget (so a manager can't promote-then-demote a super-admin), guardAdminTarget (so admins can't elevate themselves).

Every guard throws a typed AuthError that the API surface translates into a 401/403 with the right message. No silent denials. No "user is null" landmines downstream. New roles slot into the ladder without breaking existing call sites.

Related modules

Also in Sign-in and access

Bring me a real operations problem. I will show you the system running before you sign anything.

The Ops Leak Audit is the fixed-price first step: I count the hours your tools cost your team, then price the fix. Rather talk first? Book a 30-minute call. If it is not a fit, you still leave with notes you can use.

Start with the auditBook a call