How I designed permissions people can actually understand (Node + Prisma)

说明与用途

实现了基于部门的透明权限系统，自动更新用户角色变更时的权限，显示访问原因，并确保租户隔离。

问题

In many companies, it is unclear who can see a folder and why; access is granted person by person, inherited in ways forgotten, and never cleaned up.

结果

Implemented a transparent, department‑based permission system that automatically updates when users move between departments, provides clear reasons for access, and ensures tenant isolation.

工作流

• Define permissions by department and role rather than individual users.
• Implement four permission levels (MANAGE, EDIT, COMMENT, VIEW) with highest level winning.
• Allow nodes to inherit parent permissions up to the space, with the option to stop inheritance for specific nodes.
• Create a single resolveAccess function that returns both permission level and reason for each grant.
• Resolve permission trees in batches, one query per level, to avoid N+1 queries.
• Cache results per request.
• Scope all queries to a tenant‑scoped Prisma client and test isolation with integration tests.
• Deploy SpiderFolio with Docker Compose and provide documentation.

证据

Access is granted person by person, inherited in ways nobody remembers, and never cleaned up.

来源

I set one rule: every folder, file and page must show who has access and the reason, for example "Quality department · inherited from /Procedures".

来源

Access is given to departments and roles. When someone moves from Production to Quality, their access changes on its own.

来源

MANAGE > EDIT > COMMENT > VIEW. A person collects every non‑expired grant given to them and to their departments (including parent departments). If several apply, the highest level wins.

来源

Folders, files and pages form one tree. By default a node inherits its parent's access up to the space. Any node can stop inheritance, so a "Payroll" folder inside "HR" can be locked down without touching the rest.

来源

All of this lives in a single resolveAccess function backed by a table of test cases. Instead of returning only a level, it also returns the reason for each grant.

来源

Every query goes through a tenant‑scoped Prisma client, and an integration test checks that a user from company A gets a 404 on every endpoint for company B's data.

来源