Permissions

Permissions gate what users can see and do across the platform. They are resolved from the user's role at login (Keycloak) and enforced in the UI (hasPermission) and on the server (Authorizer). The canonical constants live in src/lib/services/permissions.ts (hvc-web).

Permission list

Permission	What it gates
ManageEvents	Creating, editing, joining, and deleting events (dashboard/calendar)
ManageGroups	Creating/renaming/deleting contact groups
ViewContacts	Contacts nav entry + contact list/details
ManageRoles	Admin — roles & permissions management
ManageUsers	Admin — user management (invites, pending users)
ConfigureApp	Admin — app/tenant configuration
ViewReports	Admin — analytics / reports (ECharts + Metabase)
ViewLedger	Ledger nav entry + past-event logs
ViewRecentCalls	Dashboard recent-contacts panel
Chat	Message buttons / chat access
Record	Starting/stopping recordings
TakePhoto	Camera / photo capture
UseHeadset	Headset-related capabilities
UseMobile	Mobile-related capabilities
GenerateQRCode	Generating login QR codes (mobile/headset login)
ManageUploadConfig	Admin — upload configuration (file types/sizes)
ManageAuthConfig	Admin — authentication configuration
ManageDevices	Admin — device management

File permissions

Two additional file permissions are read directly from userInfo.permissions (not the Permissions constants):

Permission	What it gates
CanDownloadFiles	Downloading shared files (gallery)
CanShareFiles	Sharing files with other contacts (gallery)

How it works

1. The user's role defines a set of permissions (configured in Roles & Permissions.
2. At login, me / tenantConfig resolves the user + their permissions into the userInfo store.
3. UI gates with hasPermission(Permissions.x) — unauthorized views/actions are hidden.
4. Server-side, the Authorizer enforces the same permissions.

Related

• Api — Auth — how identity + permissions are resolved.
• Admin — Roles / Web admin — Roles — managing roles and permissions.