Capability-baserad åtkomstkontroll

Every endpoint declares the capability it requires and goes through a centralised check before any business logic runs. POST /capability-check verifies a single capability for the calling principal; POST /capability-check-batch fans out across many for UI scenarios where a screen wants to know which actions to render. A denied check is not silent — it lands in the audit log under AuditLogDomain.CAPABILITY with actor, IP and the capability that failed, so an investigator can see who probed for what.

Capabilities aggregate over OrgNodes. GET /users/{user_id}/orgnode-capabilities/{org_node_id} computes the effective capability set for a user at a given OrgNode by walking their role assignments and filtering by scope (system, tenant, org_node). A user might be a club secretary at one club and a referee at the regional level; the resolver returns the right set for the context the request is made in, so a federation admin's cross-OrgNode view does not leak read-down by accident.

Federations get configurability through TenantCapabilityConfig: GET/PUT /tenant-capability-config/{tenant_id} lets a tenant admin disable specific capabilities or restrict the active set to particular domains. A national federation that does not run anti-doping in-house can disable the ANTI_DOPING domain; a flat-hierarchy nation can disable OrgNode capabilities it does not need. Every config change is audited.

Time-limited grants cover the operational reality of summer cover and short-term project work. Role assignments carry valid_from / valid_until; GET /capability-grants/expiring lists grants approaching expiry so a manager can extend or close them before they lapse, and GET /capability-grants/summary gives a dashboard-level view of who has what right now. Capability templates encode common role archetypes — club_secretary, regional_umpire_coordinator, treasurer — as named bundles with wildcard expansion at apply time. POST/GET/PUT/DELETE /capability-templates manages the catalogue and POST /capability-templates/{id}/apply assigns the bundle to a user-and-OrgNode pair, so onboarding a new club secretary takes one call instead of forty.