Security

1[Role] enum Role {
  /// The ephemeral principal `Login`/`Signup` run as. Never granted to a person.
  Authenticator,
  /// Submits expenses. The floor every signup lands on — no account is ever role-less (a user with no grant is
  /// denied by RLS everywhere, and cannot even read its own row).
  Employee,
  /// Approves their reports' first stage. Managerial approval is by the `Manager` LINK on User, not by this role —
  /// the role says "may approve at all", the link says "whose".
  Manager,
  /// Sees every report and every cost. The finance desk, and the audience for the cost-to-value screens.
  Finance,
  /// The third approval stage, reached only for large amounts.
  Cfo,
}

2entity RoleGrant {
  [Required] User User;
  [Required] Role Role = Role.Employee;
  security {
    allow read when IsFinance;                  // finance sees who may do what
    allow read where User == user;              // and you can see your own
    allow create, update, delete when IsFinance;
    allow create when IsAuthenticator;          // signup seeds the Employee floor (leashed by Signup's body)
  }
}

policy IsAuthenticator => RoleGrant.Any(g => g.User == user && g.Role == Role.Authenticator);
3policy IsFinance       => RoleGrant.Any(g => g.User == user && g.Role == Role.Finance);
policy IsApprover      => RoleGrant.Any(g => g.User == user && (g.Role == Role.Manager || g.Role == Role.Cfo)) || IsFinance;

1[Principal]
entity User {
  [Required, MaxLength(255), Unique("An account with that email already exists.")] string Email;
  /// Salted hash — never the plaintext. Readable ONLY by the armed authenticator (the field mask below).
  [MaxLength(200)] string? PasswordHash;
  [MaxLength(200)] string? DisplayName;
  /// Who approves this person's expenses at the first stage. The workflow's `Manager` slot assignee.
  User Manager;
  /// Stamped on every successful authentication. Null = never signed in.
  DateTime? LastLoginAt;
  [ForeignKey(User)] RoleGrant[] RoleGrants;
  security {
2    allow read when IsFinance;                     // the finance desk sees the directory
    allow read when IsAuthenticator;               // login/signup verify a credential
3    allow read where Id == user.Id;                // you read your own profile
4    allow read where Manager == user;              // a manager reads their own reports' profiles
5    deny read PasswordHash when !IsAuthenticator;  // ONLY the auth flow ever reads the hash (field mask)
    allow create, update, delete when IsFinance;
    allow create when IsAuthenticator;             // signup creates the credential
    allow update where Id == user.Id;              // you edit your own profile
6    allow update LastLoginAt when IsAuthenticator;
  }
}

app.Auth = new PasswordAuth { LoginField = Email, PasswordField = PasswordHash };