# NGBVD Permission, Scope, Integration and Audit Enforcement

This patch closes the permission gaps by enforcing permissions in three places:

1. Navigation visibility
2. Route/direct URL access
3. Data-scope filtering for users and case records

## Important change

The old administrator auto-bypass has been removed from normal permission checks. If you remove `dashboard.view` from your admin role, the dashboard will now be hidden and direct `/dashboard` access will be blocked.

Emergency break-glass access is still available but disabled by default:

```env
NGBVD_EMERGENCY_PERMISSION_BYPASS=false
NGBVD_PERMISSION_BYPASS_EMAILS=admin@mglsd.go.ug
```

Only enable it temporarily if you lock yourself out.

## User account scope

Users who can create accounts can only assign:

- districts within their allowed district scope
- partner organisations within their allowed partner scope

National scope users can assign any district/partner.

## New/updated permissions

- api_integrations.view
- api_integrations.view_api_urls
- api_integrations.manage_clients
- api_integrations.view_logs
- api_integrations.export_logs
- api_integrations.retry
- api_integrations.ubos_push
- api_integrations.sauti_push
- audit_logs.view
- audit_logs.export
- data_scope.national
- data_scope.district
- data_scope.partner
- data_scope.own_records

## Routes added

- /integrations
- /integrations/api-urls
- /integrations/api-clients
- /integrations/logs
- /audit/logs
- /audit/logs/export

## Test sequence

1. Assign a role only `dashboard.view`.
2. Login as a user with that role.
3. Confirm only Dashboard appears.
4. Paste `/roles/list` directly; it should be blocked.
5. Remove `dashboard.view` from that role.
6. Login again; Dashboard should disappear and `/dashboard` should be blocked.
7. Assign `api_integrations.view` and `api_integrations.view_logs`; Integrations Overview and Sharing Logs should appear.
8. Assign `audit_logs.view`; System Audit Logs should appear.
9. Test account creation with a district user; they should not be able to assign users outside their district.