Roles and Permissions

Neemias access control is role-based (RBAC). The permission definitions are in packages/permissions/index.ts — the single source of truth shared between frontend and backend.

Built-in Roles

Role	Permissions	Description
ADMIN	17	Full access: attendance, reports, students, users, classes, núcleos, settings, import/export
CHAMADOR	2	Mark attendance and search students
RELATORIOS	2	View reports and search students
CADASTRO	6	Register students, manage classes, núcleos, and lessons
RESPONSAVEL	1	View own children's attendance records
VOLUNTARIO	3	Mark attendance, search students, view assigned class reports
COORDENACAO_KIDS	5	Manage classes, núcleos, sessions, attendance, and students for assigned classes
ADMINISTRATIVO_KIDS	5	Manage students, sessions, attendance, and reports for assigned classes

Note: The ADMIN role always has all system permissions, regardless of future changes to the list.

Multi-role support (v0.56.0+): Users can hold multiple roles simultaneously via the user_roles join table. AuthPrincipal.roles[] contains all assigned roles; primaryRole determines the display badge. requireRole() uses roles.some() for any() match. See ADR-0022.

v0.55.1: VOLUNTEER role removed. VOLUNTARIO_KIDS renamed to VOLUNTARIO.

Complete Permission List

#	Permission	Description	ADMIN	CHAMADOR	RELATORIOS	CADASTRO
1	attendance	Mark student presence/absence	✅	✅
2	reports	Access attendance reports	✅		✅
3	students.add	Create new students	✅			✅
4	students.edit	Edit student data	✅
5	students.delete	Delete students (soft-delete with justification)	✅
6	students.search	Search and list students	✅	✅	✅	✅
7	users.view	View user list	✅
8	users.create	Create new users	✅
9	users.edit	Edit user data	✅
10	users.deactivate	Deactivate users (soft-delete)	✅
11	users.resetPassword	Reset user passwords	✅
12	settings	Access system settings	✅
13	import-export	Import and export data	✅
14	sessions.add	Create class sessions/occurrences	✅			✅
15	sessions.edit	Edit class sessions/occurrences	✅			✅
16	nuclei.manage	Create, edit, and delete núcleos	✅			✅
17	classes.manage	Create, edit, and delete classes	✅			✅

Dynamic Roles (v0.26.0+)

Starting from version 0.26.0, the system supports dynamic roles: the administrator can create custom roles with arbitrary permission sets, in addition to the four built-in roles. The permissions architecture was designed so that new roles are added with a single entry in the PERMISSIONS map, and the UserRole type is automatically derived — with no duplication of definitions.

Route Protection

On the frontend, the PermissionGuard component wraps each route and checks whether the logged-in user has the required permission. On the backend, the authentication middleware (workers/src/middleware/auth.ts) applies role verification (role guard) on every API route.

---

Sources: PRD §7 · packages/permissions/index.ts