flexport-enterprise-rbac

# Flexport Enterprise RBAC ## Overview Implement role-based access control for Flexport integrations. Since Flexport API keys are scoped at the account level, RBAC is implemented in your application layer with per-role API key allocation and request filtering. ## Instructions ### Step 1: Define Roles | Role | API Key Scope | Allowed Endpoints | Use Case | |------|--------------|-------------------|----------| | Viewer | Read-only | `GET /shipments`, `GET /products` | Dashboard users | | Operator | Read-write | `GET/POST /bookings`, `GET/PATCH /purchase_orders` | Ops team | | Finance | Read invoices | `GET /freight_invoices`, `GET /commercial_invoices` | Finance team | | Admin | Full access | All endpoints | System administrators | ### Step 2: Application-Layer RBAC ```typescript type Role = 'viewer' | 'operator' | 'finance' | 'admin'; const ROLE_PERMISSIONS: Record<Role, { methods: string[]; paths: RegExp[] }> = { viewer: { methods: ['GET'], paths: [/^\/shipments/, /^\/products/, /^\/purchase_orders/], }, operator: { methods: ['GET', 'POST', 'PATCH'], paths: [/^\/shipments/, /^\/bookings/, /^\/purchase_orders/, /^\/products/], }, finance: { methods: ['GET'], paths: [/^\/freight_invoices/, /^\/commercial_invoices/, /^\/shipments/], }, admin: { methods: ['GET', 'POST', 'PATCH', 'DELETE'], paths: [/.*/], }, }; function checkPermission(role: Role, method: string, path: string): boolean { const perms = ROLE_PERMISSIONS[rol...