Description

The current Sztab security model uses static, hardcoded roles mapped from JWTs (e.g., @PreAuthorize("hasRole('PROJECT_MANAGER')")). While sufficient for MVP, this approach becomes rigid as we expand the system to support more nuanced access needs (e.g., read-only roles, external users, community contributors).

This issue proposes a shift to a permission-based model, where roles are defined dynamically in the database and composed from atomic permissions. This unlocks fine-grained access control, runtime configurability, and future UI-driven role management.

Acceptance Criteria

•  Define and persist a Permission entity (e.g., CREATE_ISSUE, TAG_RELEASE)
•  Define a Role entity with a many-to-many relationship to Permission
•  Allow users to be assigned one or more roles
•  Update the security layer to check for hasAuthority(...) instead of hasRole(...)
•  Provide seed data mapping current static roles to equivalent permissions

Example: Permission-Based Roles

Sample Permissions

Composing Roles from Permissions

Controller Check (Post-Migration)

@PreAuthorize("hasAuthority('ASSIGN_ISSUE')")
public ResponseEntity<?> assignIssue(...) {
    // only Project Manager (or anyone with this permission) can access
}