Group Membership & Scoped Permissions

Association and leadership inside groups are tracked at the individual contact level via the group_members junction.

1. Group Roles (role)

Every member in a group is assigned a role in group_members which determines their capabilities and directory designation:

• leader: The main servant responsible for the group. Has access to manage rosters, edit details, and record meeting attendance.
• co_leader: Assistant leader with similar operational access to support the group’s activities.
• member: General participant enrolled in the group.
• volunteer: Helper or occasional servant attached to the group.

2. Group-Scoped RBAC Permissions

Kononia’s Dynamic RBAC system supports scoping permission grants to specific entities. This is defined in public.user_church_roles using the group_id column.

[User Session]
      │
      ├─► Global Role: (group_id = NULL) ──► Global Access (All groups)
      │
      └─► Scoped Role: (group_id = 123)  ──► Scoped Access (Only Group 123)

Scoped Leadership Access

• Roster & Detail Management: A user with the role “Group Servant” scoped to a specific group_id inherits groups.view and groups.manage permissions only for that group.
• Isolating Administrative Control: Scoped leaders can add members, update meeting details, and review reports for their assigned group, but are restricted from editing or viewing other groups in the organization.
• UI Resolution: The usePermissions hook evaluates scopes automatically via canForGroup(permissionKey, groupId), selectively enabling controls on group detail pages.