Complete inventory of all 135+ permissions across 14 microservices with sync status, role matrix, and critical security findings
Complete analysis of the permission system across all MQUAD microservices. The system uses multi-layered RBAC with 135+ permissions distributed across 14 services.
Service Permission Summary
Service
Port
Perm Count
Sync Status
Orphaned
Backend (Core RBAC)
8000
52
N/A
N/A
Survey Service
8001
9
Partial
3
Data Service
8002
15
Partial
6
Sync Service
8003
10
Partial
2
Form Service
8004
21
Full
0
Analytics Service
8005
9
Not Synced
8
Workspace Service
8006
9
Not Synced
6
Webhook Service
8007
5
Not Synced
5
Notification Service
8008
0
Not Synced
0
Audit Service
8010
0
Not Synced
0
Media Service
8011
0
Not Synced
0
Feature Flags Service
8013
0
Not Synced
0
TOTAL
135+
48 (36%)
38+ (28%)
Critical Security Issues
#
Issue
Service
Impact
1
No permission checks - any authenticated user can access ALL audit logs
Audit
Data exposure
2
No permission checks - any user can manage ALL notifications
Notification
Spam/abuse
3
No permission checks - any user can access ALL media
Media
Data exposure
4
Anonymous ingestion allowed - anyone can write audit logs
Audit
Log injection
5
Anonymous downloads - media downloadable without auth
Media
Data exposure
Default Roles
Role
Description
Permission Count
Super Admin
System-wide access
4
Admin
Full application access
52+
User
Regular user with self-management
16
Guest
Read-only access
2
Billing Manager
Billing and payments only
4
Survey Manager
Survey CRUD and management
16
Form Builder
Form creation and modification
9
Field Supervisor
Enumerator oversight
16
Enumerator
Form filling and submission
11
Data Analyst
Analytics and export
4
Viewer
Read-only form/dashboard access
3
Recommendations
Immediate Actions (P0)
Add permission checks to Audit, Notification, Media, Feature Flags
Add audit_logs:view_only enforcement
Fix anonymous access to audit logs and media
High Priority (P1)
Add missing permissions to backend enum for Survey, Analytics, Workspace, Webhook
