Permission Management

Purpose  - Control what employees can do inside a school, and what DHE staff can do inside the DHE portal.

Who Can Use It 

• School Admin: grant, revoke, and view permissions for their school's employees.
• DHE Admin: manage permissions in DHE scope. 
• Employees: view their own permissions. 

Key Capabilities 

• List All Permissions: the master catalog, scoped either "school" or "dhe" (chosen from the caller's role, or narrowed via a scope parameter). 
• List All Custom User Permissions: assigned permission records across users.
• Get User Permissions: fetch a specific employee's permissions inside a specific school.
• When the caller is an employee, the response also returns the full master catalog so the UI can render the code and name mapping. 
• Update User Permission: set or replace an employee's permissions, each with an optional validity window. 
• Get Users With Permission: list every employee who currently holds a given permission code, optionally filtered by school. 
• Employees With Permissions: for one school, list all employees that hold at least one permission. 
• Designation Permissions: 
• Get by designation ID or by designation name.
• Replace (set) all permissions for a given designation. 

How It Works 

• The master permission catalog is defined per scope ("school" or "dhe").
• School Admin picks an employee and assigns them one or more permissions from the school catalog, with optional validity dates. 
• Designations created in the organogram or org tools can be mapped to sets of permissions here so members of that designation inherit them. 

Rules & Restrictions 

• Only School Admin and DHE can manage custom permissions. 
• Admin designations cannot be given custom permissions — they already carry full permissions by default; attempting to map custom permissions is rejected.
• Permission codes are unique per scope. The same numeric code can exist once in "school" and once in "dhe" with different meanings. 
• Time-bound permissions honor the "valid from" and "valid to" window; expired rows are considered inactive for lookups such as "Employees With Permissions".