hubspot-enterprise-rbac

# HubSpot Enterprise RBAC ## Overview Implement role-based access control for HubSpot integrations using OAuth scopes, multiple private apps with different permissions, and application-level authorization. ## Prerequisites - HubSpot Enterprise subscription (for team-level permissions) - Understanding of HubSpot OAuth scopes - Multiple private apps or OAuth app configured ## Instructions ### Step 1: Scope-Based Access Model HubSpot's permission model is scope-based. Create separate private apps for different access levels: | Role | Private App | Scopes | Use Case | |------|-----------|--------|----------| | Reader | `hubspot-readonly` | `crm.objects.contacts.read`, `crm.objects.deals.read`, `crm.objects.companies.read` | Dashboards, reports | | Writer | `hubspot-readwrite` | Above + `.write` variants | CRM operations | | Admin | `hubspot-admin` | All CRM scopes + `crm.schemas.*.read` | Schema management | | Sync | `hubspot-sync` | `crm.objects.contacts.read`, `crm.objects.contacts.write`, `crm.import` | Data sync jobs | | Webhook | `hubspot-webhook` | `automation` | Event handling only | ### Step 2: Multi-Token Client Factory ```typescript import * as hubspot from '@hubspot/api-client'; type AccessLevel = 'reader' | 'writer' | 'admin' | 'sync'; const TOKEN_MAP: Record<AccessLevel, string> = { reader: process.env.HUBSPOT_READER_TOKEN!, writer: process.env.HUBSPOT_WRITER_TOKEN!, admin: process.env.HUBSPOT_ADMIN_TOKEN!, sync: process.env.HUBSPOT_SYNC_TOKEN!, }...