# Admin Role Access Levels Documentation

## Overview
The CURA platform implements a role-based access control (RBAC) system with 5 distinct admin roles, each with specific permissions and module access.

---

## Role Hierarchy & Capabilities

### 1. Super Administrator (`super_admin`)
**Hierarchy Level:** 5 (Highest)

**Description:** Full system access and control. Complete management of all platform aspects.

**Permissions:**
- ✅ Admin Management (Create, Edit, Delete, View Logs)
- ✅ System Settings (View & Manage)
- ✅ Database Management
- ✅ Backup Management
- ✅ Nurses Management (Full Control)
- ✅ Employers Management (Full Control)
- ✅ Jobs Management (Full Control)
- ✅ Bookings Management
- ✅ Content Moderation
- ✅ Reports & Analytics (All Types)
- ✅ Financial Reports & Transactions
- ✅ Communication & Notifications

**Accessible Modules:**
- Admin Management
- System Settings
- Nurses Management
- Employers Management
- Jobs Management
- Bookings & Applications
- Content Moderation
- Reports & Analytics
- Financial Management
- Communication

**Special Abilities:**
- Can edit and manage all roles
- Can suspend/delete other admins
- Unrestricted access to all features
- Can export all data and reports

---

### 2. Operations Administrator (`operations_admin`)
**Hierarchy Level:** 4

**Description:** Manage platform operations, users, and content. Primary operational role.

**Permissions:**
- ✅ View System Settings (Read-Only)
- ✅ Nurses Management (Create, Edit, Verify, Approve, Suspend)
- ✅ Employers Management (Create, Edit, Approve, Suspend)
- ✅ Jobs Management (Create, Edit, Approve, Suspend)
- ✅ Bookings Management (Approve, Reject)
- ✅ Content Moderation
- ✅ Reports & Analytics (View & Export)
- ✅ Communication & Notifications
- ❌ Admin Management
- ❌ Database Management
- ❌ Financial Management (View only with Finance Admin)

**Accessible Modules:**
- Nurses Management
- Employers Management
- Jobs Management
- Bookings & Applications
- Content Moderation
- Reports & Analytics
- Communication

**Special Abilities:**
- Approve/reject nurse credentials
- Approve/reject employer accounts
- Manage content moderation
- Generate operational reports
- Send system notifications

---

### 3. Content Moderator (`moderator`)
**Hierarchy Level:** 1 (Lowest)

**Description:** Monitor and moderate user-generated content and reports.

**Permissions:**
- ✅ View Nurses (Read-Only)
- ✅ View Employers (Read-Only)
- ✅ View Jobs (Read-Only)
- ✅ View Bookings (Read-Only)
- ✅ Content Moderation (Flag, Remove)
- ✅ View Reports
- ❌ Create, Edit, Delete Resources
- ❌ Approve/Reject Submissions
- ❌ Access Financial Data
- ❌ Manage Users Directly

**Accessible Modules:**
- Content Moderation
- Reports & Analytics (View Only)

**Special Abilities:**
- Flag inappropriate content
- Ban users for violations
- View moderation reports
- Monitor flagged content queue

---

### 4. Employer Account Manager (`employer_manager`)
**Hierarchy Level:** 2

**Description:** Manage employer accounts and their job postings. Support employer relationships.

**Permissions:**
- ✅ View Employers (Full)
- ✅ Manage Employers (Create, Edit, Verify)
- ✅ View Jobs (Full)
- ✅ Manage Jobs (Create, Edit)
- ✅ View Job Applications
- ❌ Delete Employers/Jobs
- ❌ Approve Employers (Operations Admin only)
- ❌ Manage Nurses
- ❌ Content Moderation
- ❌ View Financial Data

**Accessible Modules:**
- Employers Management
- Jobs Management

**Special Abilities:**
- Direct support for employer accounts
- Manage employer job postings
- View and manage applications
- Limited employer-related reporting

---

### 5. Finance Administrator (`finance_admin`)
**Hierarchy Level:** 3

**Description:** Manage financial transactions and generate financial reports.

**Permissions:**
- ✅ Manage Transactions
- ✅ View Transactions
- ✅ Financial Reports (View & Export)
- ✅ View Analytics
- ✅ View Dashboard (Financial Overview)
- ❌ Manage Users
- ❌ Approve Content/Jobs
- ❌ Content Moderation
- ❌ System Settings

**Accessible Modules:**
- Financial Management
- Reports & Analytics

**Special Abilities:**
- Process payments and refunds
- Generate financial reports
- Track transaction history
- View revenue analytics
- Export financial data

---

## Permission Matrix

| Permission | Super Admin | Ops Admin | Moderator | Employer Mgr | Finance |
|-----------|:-:|:-:|:-:|:-:|:-:|
| Manage Admins | ✅ | ❌ | ❌ | ❌ | ❌ |
| System Settings | ✅ | ✅* | ❌ | ❌ | ❌ |
| Manage Nurses | ✅ | ✅ | ❌ | ❌ | ❌ |
| Manage Employers | ✅ | ✅ | ❌ | ✅ | ❌ |
| Manage Jobs | ✅ | ✅ | ❌ | ✅ | ❌ |
| Manage Bookings | ✅ | ✅ | ❌ | ❌ | ❌ |
| Moderation | ✅ | ✅ | ✅ | ❌ | ❌ |
| View Reports | ✅ | ✅ | ✅ | ❌ | ✅ |
| Financial Reports | ✅ | ✅ | ❌ | ❌ | ✅ |
| Transactions | ✅ | ❌ | ❌ | ❌ | ✅ |

*Read-only access

---

## Implementation Guide

### Using Permissions in Controllers

```php
use App\Traits\AdminAuthorization;

class AdminController extends Controller
{
    use AdminAuthorization;

    public function deleteAdmin($admin)
    {
        // Check permission
        $this->authorizePermission('delete_admin');
        
        // Or authorize role
        $this->authorizeRole('super_admin');
        
        // Or check if can manage specific admin
        $this->authorizeAdminManagement($admin);
        
        // Perform action
        $admin->delete();
    }
}
```

### Using Permissions in Routes

```php
// Check permission
Route::delete('/admins/{admin}', 'AdminController@delete')
    ->middleware('admin.permission:delete_admin');

// Check role
Route::post('/admins', 'AdminController@store')
    ->middleware('admin.role:super_admin');

// Check multiple roles
Route::get('/nurses', 'NurseController@index')
    ->middleware('admin.role:super_admin,operations_admin');
```

### Using Permissions in Views/Blade

```blade
@can('manage_admins', auth('admin')->user())
    <a href="/admin/admins/create">Create Admin</a>
@endcan

@if(auth('admin')->user()->hasPermission('manage_nurses'))
    <!-- Show nurses management section -->
@endif

@if(auth('admin')->user()->hasModuleAccess('moderation'))
    <!-- Show moderation module -->
@endif
```

---

## Adding New Permissions

Edit `config/admin_permissions.php` and add to the permissions array:

```php
'your_new_permission' => ['super_admin', 'operations_admin'],
```

---

## Managing Access Programmatically

```php
use App\Services\AdminPermissionService;

// Get all permissions for a role
$permissions = AdminPermissionService::getRolePermissions('operations_admin');

// Check if role can manage resource
$canManage = AdminPermissionService::canManage('employer_manager', 'employers');

// Get role modules
$modules = AdminPermissionService::getRoleModules('finance_admin');

// Check hierarchy
$canManage = AdminPermissionService::canManageRole('operations_admin', 'moderator');

// Get dashboard config
$widgets = AdminPermissionService::getDashboardWidgets('super_admin');
```

---

## Security Considerations

1. **Always validate permissions** on the server-side, never rely on client-side checks
2. **Use role-based middleware** to protect sensitive routes
3. **Log all admin actions** for audit trails
4. **Check permissions before operations** that affect data
5. **Hierarchy enforcement** prevents lower-role admins from managing higher-role admins
6. **Regular permission audits** to ensure proper access levels

---

## Dashboard Access by Role

| Role | Dashboard Type | Key Widgets |
|------|---|---|
| Super Admin | System Overview | System health, user stats, activity, growth, finances |
| Operations Admin | Operations | User stats, activity, growth, pending approvals |
| Moderator | Moderation | Moderation queue, flagged content, reports |
| Employer Manager | Employer | Employer stats, job postings, applications |
| Finance Admin | Financial | Finances, transactions, revenue charts |