Users, Roles, and Permissions
Learn how AutoCore separates user identity, hierarchical roles, and fine-grained permissions.
AutoCore has three related but different authorization concepts:
- A user is an identity with account status, authentication identities, sessions, profile, and optional memberships.
- A role is a hierarchical platform position:
user,moderator,admin, orsuper_admin. - A permission is a fine-grained capability such as
listing.create,listing.moderate, orcatalog.read.
Enforcement model
Role checks use the current role hierarchy. Permission checks require every
declared permission unless the user is a super_admin, which is the explicit
platform bypass. Resource ownership and dealer membership remain additional
service-level checks; a role alone does not make every listing or dealer record
accessible.
| Participant | Scope |
|---|---|
| User | Own profile, sessions, saved searches, favorites, and owned listings where allowed |
| Moderator | Elevated moderation responsibilities assigned by role/permission |
| Admin | Broader marketplace and platform administration |
| Super admin | Highest role; bypasses permission checks in the current guard |
| Dealer member | Dealer-scoped role, separate from platform RBAC |
Authentication provider names (email, google, phone, apple) describe the
provider abstraction. The current constants identify email as functional in the
foundation phase; other providers remain feature-flagged or placeholder paths
unless current configuration proves otherwise.