User Story #666
Updated by Islam Mansoori about 1 month ago
As a platform user, I want to see Role Management Objective Ensure every user has the correct role so they only the access features that belong to my role, So that I can easily perform my responsibilities without seeing features that I am not authorized to access. --- # Business Background The platform supports four user intended for them. Supported roles: - Customer - Partner (B2B Travel Agent) - Supplier - Super Admin Each role has different permissions and should have a different user experience throughout the application. The interface should automatically adapt based on the logged-in user's assigned role. --- # Functional Requirements ## 1. Role-Based Home Screen After successful login, the user Customer Role Every newly registered customer shall be directed to automatically receive the appropriate home page according to their assigned Customer role. | **User Role** | **Landing Page** | | ------------- | --------------------------------- | 2. Role Display | Customer | Customer Dashboard | The user's assigned role shall be visible within their account settings. | Partner | Partner Dashboard | 3. Feature Access | Supplier | Supplier Dashboard (Future Phase) | | Super Admin | Admin Dashboard | --- ## 2. Navigation Menu The navigation menu Each role shall display only see the features available to the logged-in user's role. The user shall never see menu items that they are not authorized to access. Example them. Examples: Customer should see - Home - Browse Packages - Flights - Wishlist - My Request Quotes - My View Bookings - My Profile Customer should NOT see - Package Management Partner - User Management View B2B Pricing - Submit Partner Management Enquiries - Supplier Management - Reports Manage Supplier Content (future phase) - Platform Settings --- Partner should additionally see - B2B Pricing - Partner Dashboard - Partner Quotes --- Super Admin shall see - Dashboard - Packages Complete platform management - Flights 4. Unauthorized Access - Customers - Partners - Suppliers - Reports - Settings - User Management - Activity Logs --- ## 3. Display Logged-in Role The user's current role shall be visible inside the profile section. Example Role Customer or Partner or Supplier or Super Admin --- ## 4. Restricted Menu Items Menu items that the If a user is not authorized attempts to access shall not be displayed. The application shall never display disabled menu items for restricted features. --- ## 5. Direct URL Access If the user manually enters the URL of a restricted page, The page shall not open. Display > **You Display: You do not have permission to access this page.** Provide a button > **Return to Dashboard** --- ## 6. page. 5. Unknown Role If the application cannot determine the user's role, Display > **We're unable to determine your account permissions. Please sign in again.** Provide button > **Go to Login** --- ## 7. Session Role Change If the user's no valid role changes while they are signed in, The application shall notify the user. Display > **Your account permissions have changed. Please sign in again to continue.** After acknowledgement, Return the user to the Login page. --- ## 8. Loading State While permissions are being loaded, Display - Loading indicator exists, - No navigation menu Display: - No page content The user shall not briefly see unauthorized menus. --- ## Validation Rules No manual validation is required. The application shall always rely on the assigned user role. --- # User Messages ## Unauthorized Access > You do not have permission Unable to access this page. --- ## Unknown Role > We're unable to determine your account permissions. Please sign in again. --- ## Permission Changed > Your account permissions have changed. Please sign in again to continue. --- ## contact support. Acceptance Criteria ### Scenario 1 Given a Customer logs in When the dashboard opens Then Every account has one valid role. Users only Customer menus shall be visible. --- ### Scenario 2 Given a Partner logs in When navigation loads Then B2B access features shall be visible. --- ### Scenario 3 Given a Customer manually enters an Admin URL When the page loads Then the page shall not open. Display > You do not have permission to permitted for their role. Clear messages are displayed when access this page. --- ### Scenario 4 Given the user's role cannot be identified When the application loads Then Display > We're unable to determine your account permissions. Please sign in again. --- ### In Scope - Role-based navigation is denied. - Role-based landing pages - Unauthorized page handling - Display current role - Permission refresh --- ### Out of Scope - Creating new roles - Editing permissions - Assigning users to roles - Staff administration ---