feat(rbac): role-based access control module #14310

carlos-r-l-rodrigues · 2025-12-15T14:26:39Z

What

Initial RBAC module, workflow and endpoint implementation

Note

Introduce RBAC module with roles, policies, role-policies, and inheritance, exposing workflows and Admin API CRUD, plus integration tests and wiring across types/utils/config.

Backend Module (@medusajs/rbac):
- Add models: rbac_role, rbac_policy, rbac_role_policy, rbac_role_inheritance with indexes and migrations.
- Implement RbacModuleService and RbacRepository (policy listing with inheritance; augment role listings to include policies).
- Register module in configs and Modules constants; add IRbacModuleService and RBAC DTOs/types.
Core Flows:
- Steps and workflows to create/update/delete rbac_roles, rbac_policies, rbac_role_policies; manage role inheritance (set-role-inheritance); expose via core-flows.
Admin API:
- New routes: GET/POST /admin/rbac/roles, GET/POST/DELETE /admin/rbac/roles/:id.
- New routes: GET/POST /admin/rbac/policies, GET/POST/DELETE /admin/rbac/policies/:id.
- New routes: GET/POST /admin/rbac/role-policies, GET/POST/DELETE /admin/rbac/role-policies/:id.
- Add validators, query-config, and middleware registration.
Types/Utils:
- Export RBAC types (common, mutations, service), extend container typings; add Modules.RBAC mappings.
Tests:
- Integration tests for Admin API CRUD and filtering; workflow tests for role inheritance and policy aggregation.
Config:
- Enable RBAC module in test configs and API middleware aggregation.

^{Written by Cursor Bugbot for commit 3d63ef0. This will update automatically on new commits. Configure here.}

…t/rbac-module

changeset-bot · 2025-12-15T14:26:44Z

⚠️ No Changeset found

Latest commit: 3d63ef0

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

vercel · 2025-12-15T14:26:44Z

The latest updates on your projects. Learn more about Vercel for GitHub.

8 Skipped Deployments

Project	Deployment	Review	Updated (UTC)
api-reference	Ignored		Dec 22, 2025 11:44am
api-reference-v2	Ignored	Preview	Dec 22, 2025 11:44am
cloud-docs	Ignored	Preview	Dec 22, 2025 11:44am
docs-ui	Ignored	Preview	Dec 22, 2025 11:44am
docs-v2	Ignored	Preview	Dec 22, 2025 11:44am
medusa-docs	Ignored	Preview	Dec 22, 2025 11:44am
resources-docs	Ignored	Preview	Dec 22, 2025 11:44am
user-guide	Ignored	Preview	Dec 22, 2025 11:44am

olivermrbl

Overall LGTM, a few suggestions and comments

packages/modules/rbac/src/models/rbac-role.ts

packages/modules/rbac/src/models/rbac-role-policy.ts

packages/modules/rbac/src/models/rbac-policy.ts

packages/modules/rbac/src/models/rbac-role-inheritance.ts

olivermrbl · 2025-12-16T12:55:15Z

packages/modules/rbac/src/models/rbac-role-policy.ts

+  .define("rbac_role_policy", {
+    id: model.id({ prefix: "rlpl" }).primaryKey(),
+    role: model.belongsTo(() => RbacRole),
+    scope: model.belongsTo(() => RbacPolicy),


suggestion: wouldn't it make more sense to call this policy?

Suggested change

scope: model.belongsTo(() => RbacPolicy),

policy: model.belongsTo(() => RbacPolicy),

resurfacing this one

olivermrbl · 2025-12-16T12:55:59Z

packages/modules/rbac/src/models/rbac-role-inheritance.ts

+  .define("rbac_role_inheritance", {
+    id: model.id({ prefix: "rlin" }).primaryKey(),
+    role: model.belongsTo(() => RbacRole, { mappedBy: "inherited_roles" }),
+    inherited_role: model.belongsTo(() => RbacRole, {


suggestion: we have historically used parent_ for inheritance relationships; would it make sense to use it here too? not a strong opinion, so also fine to keep as is

…t/rbac-module

cursor

This is the final PR Bugbot will review for you during this billing cycle

Your free Bugbot reviews will reset on January 17

Details

Your team is on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle for each member of your team.

To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.

cursor · 2025-12-22T11:48:16Z

packages/core/core-flows/src/rbac/workflows/update-rbac-roles.ts

+      }
+    )
+
+    createRbacRolePoliciesStep(policiesUpdateData)


Update workflow only adds policies, never removes existing

The updateRbacRolesWorkflow handles policy_ids inconsistently with inherited_role_ids. For inheritance, setRoleInheritanceStep properly syncs by fetching existing records, comparing, removing old ones, and adding new ones. However, for policies, it uses createRbacRolePoliciesStep which only creates new associations without removing existing ones. When a user updates a role with policy_ids, they expect it to replace all policies, but instead it only appends new ones. This means clearing policies with an empty array won't work, and updating with a subset of policies will accumulate rather than replace.

cursor · 2025-12-22T11:48:16Z

packages/medusa/src/api/admin/rbac/roles/validators.ts

+  q: z.string().optional(),
+  id: z.union([z.string(), z.array(z.string())]).optional(),
+  name: z.union([z.string(), z.array(z.string())]).optional(),
+  parent_id: z.union([z.string(), z.array(z.string())]).optional(),


Validators reference nonexistent parent_id model field

The API validators (AdminGetRbacRolesParamsFields, AdminCreateRbacRole, AdminUpdateRbacRole) and defaultAdminRbacRoleFields query config all reference a parent_id field that doesn't exist in the RbacRole model. The model only defines id, name, description, and metadata. Role inheritance is handled through the separate RbacRoleInheritance table, not a parent_id column. This will cause failures when filtering by parent_id, creating/updating with parent_id, or when the default query fields are requested.

Additional Locations (2)

packages/medusa/src/api/admin/rbac/roles/validators.ts#L35-L36

packages/medusa/src/api/admin/rbac/roles/query-config.ts#L3-L4

olivermrbl

Overall LGTM, few comments and suggestions

olivermrbl · 2025-12-22T15:06:18Z

packages/core/core-flows/src/rbac/steps/set-role-inheritance.ts

+      role_id: string
+      previousInheritedRoleIds: string[]


super-nit: think we should align casing 😅

olivermrbl · 2025-12-22T15:10:22Z

packages/medusa/src/api/admin/rbac/middlewares.ts

+import { adminRbacRolePolicyRoutesMiddlewares } from "./role-policies/middlewares"
+import { adminRbacRoleRoutesMiddlewares } from "./roles/middlewares"
+
+export const adminRbacRoutesMiddlewares: MiddlewareRoute[] = [


q: should we omit this file if the feature flag is not enabled?

olivermrbl · 2025-12-22T15:11:12Z

packages/medusa/src/api/admin/rbac/policies/middlewares.ts

+  AdminUpdateRbacPolicy,
+} from "./validators"
+
+export const adminRbacPolicyRoutesMiddlewares: MiddlewareRoute[] = [


Same as other comment

separately: I am leaning toward removing the rbac resource from the API; I think this goes against our general conventions, and I doubt we will have other features needing the routes without it

olivermrbl · 2025-12-22T15:11:12Z

packages/medusa/src/api/admin/rbac/policies/middlewares.ts

+  AdminUpdateRbacPolicy,
+} from "./validators"
+
+export const adminRbacPolicyRoutesMiddlewares: MiddlewareRoute[] = [


Same as other comment

olivermrbl · 2025-12-22T15:13:39Z

packages/medusa/src/api/admin/rbac/role-policies/middlewares.ts

+  AdminUpdateRbacRolePolicy,
+} from "./validators"
+
+export const adminRbacRolePolicyRoutesMiddlewares: MiddlewareRoute[] = [


Same as other comment

olivermrbl · 2025-12-22T15:16:03Z

packages/modules/rbac/src/models/rbac-role-policy.ts

+  .define("rbac_role_policy", {
+    id: model.id({ prefix: "rlpl" }).primaryKey(),
+    role: model.belongsTo(() => RbacRole),
+    scope: model.belongsTo(() => RbacPolicy),


resurfacing this one

carlos-r-l-rodrigues added 5 commits December 11, 2025 14:15

wip

6c3fd85

base routes and workflows

3fbd041

wip

3d68622

Merge branch 'develop' of https://github.com/medusajs/medusa into fea…

f39b14e

…t/rbac-module

http tests

2b5940e

github-actions bot added type: feature team: medusa labels Dec 15, 2025

carlos-r-l-rodrigues changed the title ~~Feat/rbac module~~ feat(rbac): Role-based access control module Dec 15, 2025

carlos-r-l-rodrigues changed the title ~~feat(rbac): Role-based access control module~~ feat(rbac): role-based access control module Dec 15, 2025

rm helpers

2515bc9

olivermrbl reviewed Dec 16, 2025

View reviewed changes

carlos-r-l-rodrigues and others added 6 commits December 19, 2025 06:07

Merge branch 'develop' of https://github.com/medusajs/medusa into fea…

12554c5

…t/rbac-module

merge

236c740

Merge branch 'develop' into feat/rbac-module

dc0d431

Merge branch 'develop' into feat/rbac-module

efff36b

Merge branch 'develop' into feat/rbac-module

5d647c1

Merge branch 'develop' into feat/rbac-module

39dd528

carlos-r-l-rodrigues marked this pull request as ready for review December 22, 2025 11:39

carlos-r-l-rodrigues requested a review from a team as a code owner December 22, 2025 11:39

yarn

3d63ef0

cursor bot reviewed Dec 22, 2025

View reviewed changes

olivermrbl approved these changes Dec 22, 2025

View reviewed changes

	scope: model.belongsTo(() => RbacPolicy),
	policy: model.belongsTo(() => RbacPolicy),

Uh oh!

feat(rbac): role-based access control module #14310

Are you sure you want to change the base?

feat(rbac): role-based access control module #14310

Conversation

carlos-r-l-rodrigues commented Dec 15, 2025 • edited by cursor bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot bot commented Dec 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

vercel bot commented Dec 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

olivermrbl left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

This is the final PR Bugbot will review for you during this billing cycle

Uh oh!

cursor bot Dec 22, 2025

Choose a reason for hiding this comment

Update workflow only adds policies, never removes existing

Uh oh!

cursor bot Dec 22, 2025

Choose a reason for hiding this comment

Validators reference nonexistent parent_id model field

Uh oh!

olivermrbl left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

carlos-r-l-rodrigues commented Dec 15, 2025 •

edited by cursor bot

Loading

changeset-bot bot commented Dec 15, 2025 •

edited

Loading

vercel bot commented Dec 15, 2025 •

edited

Loading