Authentication and RBAC

Mettada’s consumer manifest can opt into the platform’s authentication / user-management and RBAC feature specs. In mettada.yaml, feature flags are explicit choices:

features:
  authentication: true
  rbac: true

The feature packs contribute their own user and role entity/workspace specs during lint and sync. Inspect the generated output and feature specs in the current checkout before assuming a particular login provider or permission policy is configured.

Entity permissions and route middleware can be declared in the entity spec:

version: 1
entity:
  name: Customer
  label: Customer
  plural: Customers
meta:
  timestamps: true
fields:
  name:
    type: string
    required: true
permissions:
  view: customer.view
  create: customer.create
  update: customer.update
  delete: customer.delete
routes:
  resource: true
  api: true
  middleware:
    - auth

Workspace navigation and section-level permission metadata can further control what the generated UI presents. UI visibility is not backend authorization: protect custom endpoints with the consumer’s server-side policies or middleware, and test both allowed and denied requests.

After changing feature flags, run:

php backend-laravel/bin/mettada mettada:lint Workshop
php backend-laravel/bin/mettada mettada:sync Workshop

Install and configure any required consumer framework dependencies, seed users/roles intentionally, and verify the authentication flow before exposing the application. Do not assume that enabling a manifest flag provisions production identities or supplies application-specific role assignments.