feat: Introduce Administrator permission and update permissions checks for access control

imphnen-backend/src/bin/seed_roles_permissions.rs

@@ -28,45 +28,8 @@ async fn main() -> Result<(), Box<dyn Error>> {
 		(
 			"f6b03f25-e416-4893-ac88-caaa690afb07",
 			vec![
-				PermissionsEnum::ReadListUsers,
+				// Only Administrator permission - grants access to everything
-				PermissionsEnum::ReadDetailUsers,
+				PermissionsEnum::Administrator,
-				PermissionsEnum::CreateUsers,
-				PermissionsEnum::DeleteUsers,
-				PermissionsEnum::UpdateUsers,
-				PermissionsEnum::ActivateUsers,
-				// Full admin permissions
-				PermissionsEnum::ManageAllUsers,
-				PermissionsEnum::ManageAllRoles,
-				PermissionsEnum::ManageAllPermissions,
-				PermissionsEnum::ManageAllTeams,
-				PermissionsEnum::ViewAllSensitiveData,
-				PermissionsEnum::AccessAdminDashboard,
-				PermissionsEnum::ReadListRoles,
-				PermissionsEnum::ReadDetailRoles,
-				PermissionsEnum::CreateRoles,
-				PermissionsEnum::DeleteRoles,
-				PermissionsEnum::UpdateRoles,
-				PermissionsEnum::ReadListPermissions,
-				PermissionsEnum::ReadDetailPermissions,
-				PermissionsEnum::CreatePermissions,
-				PermissionsEnum::DeletePermissions,
-				PermissionsEnum::UpdatePermissions,
-				PermissionsEnum::CreateGachaClaims,
-				PermissionsEnum::ReadDetailGachaClaims,
-				PermissionsEnum::ReadListGachaItems,
-				PermissionsEnum::ReadDetailGachaItems,
-				PermissionsEnum::CreateGachaItems,
-				PermissionsEnum::DeleteGachaItems,
-				PermissionsEnum::UpdateGachaItems,
-				PermissionsEnum::ReadDetailGachaRolls,
-				PermissionsEnum::CreateGachaRolls,
-				PermissionsEnum::ExecuteGachaRolls,
-				PermissionsEnum::ReadListMentors,
-				PermissionsEnum::ReadDetailMentors,
-				PermissionsEnum::RegisterMentors,
-				PermissionsEnum::UpdateMentors,
-				PermissionsEnum::VerifyMentors,
-				PermissionsEnum::DeleteMentors,
 			],
 		),
 		(

imphnen-iam/src/v1/permissions/permissions_enum.rs

@@ -123,6 +123,7 @@ impl fmt::Display for PermissionsEnum {
 			PermissionsEnum::ManageAllTeams => "Manage All Teams",
 			PermissionsEnum::ViewAllSensitiveData => "View All Sensitive Data",
 			PermissionsEnum::AccessAdminDashboard => "Access Admin Dashboard",
+			PermissionsEnum::Administrator => "Administrator",
 		};
 		write!(f, "{permission_str}")
 	}
@@ -188,6 +189,7 @@ impl PermissionsEnum {
 			PermissionsEnum::ManageAllTeams => "a3b4c5d6-7890-1234-5678-3456789012ab".to_string(),
 			PermissionsEnum::ViewAllSensitiveData => "b4c5d6e7-8901-2345-6789-4567890123ab".to_string(),
 			PermissionsEnum::AccessAdminDashboard => "c5d6e7f8-9012-3456-7890-5678901234ab".to_string(),
+			PermissionsEnum::Administrator => "administrator-permission-id-123456789".to_string(),
 		}
 	}
 	
@@ -256,6 +258,7 @@ impl PermissionsEnum {
 			PermissionsEnum::ManageAllTeams,
 			PermissionsEnum::ViewAllSensitiveData,
 			PermissionsEnum::AccessAdminDashboard,
+			PermissionsEnum::Administrator,
 		]
 	}
 }

imphnen-middleware/src/permissions_middleware/mod.rs

@@ -89,7 +89,10 @@ where
 			};
 			let user_permissions: Vec<String> =
 				user.role.permissions.into_iter().map(|p| p.name).collect();
-			let allowed = permissions
+			
+			// Check if user has Administrator permission - if yes, allow access to everything
+			let has_administrator_permission = user_permissions.contains(&PermissionsEnum::Administrator.to_string());
+			let allowed = has_administrator_permission || permissions
 				.iter()
 				.all(|p| user_permissions.contains(&p.to_string()));
 			if !allowed {