My permissions

GET /api/permisos/mis-permisos/:idPerfil Joins permisos_perfil with modulo and returns a Record<string, PermisosAccion> indexed by the uppercased module name. This is the key endpoint for RBAC enforcement in the frontend. useAuth.ts calls this endpoint inside cargarMisPermisos() immediately after a successful login and again when the session is restored on page refresh. The result is stored in the global misPermisos state and later checked via tienePermiso(nombreModulo, accion).

Path parameters

number

required

ID of the profile whose permission map you want to load.

Response

boolean

required

true when the query completes without error.

object

required

A plain object whose keys are uppercase module names (e.g. "USUARIO", "PERFIL") and whose values are PermisosAccion objects. Returns an empty object {} when the profile has no assigned permissions.

Show PermisosAccion properties

boolean

Read/list access.

boolean

Create access.

boolean

Edit access.

boolean

Delete access.

boolean

Detail-view access.

`PermisosAccion` interface

Defined in app/composables/useAuth.ts:

export interface PermisosAccion {
  bitConsulta: boolean;
  bitAgregar: boolean;
  bitEditar: boolean;
  bitEliminar: boolean;
  bitDetalle: boolean;
}

The global permissions state is typed as Record<string, PermisosAccion> and accessed via tienePermiso(nombreModulo, accion), which looks up the module name in uppercase and returns false if the key does not exist:

const tienePermiso = (nombreModulo: string, accion: keyof PermisosAccion) => {
  const modulo = misPermisos.value[nombreModulo.toUpperCase()]
  return modulo ? modulo[accion] : false
}

Error response

500

{
  "statusCode": 500,
  "message": "Error al cargar los permisos del usuario"
}

Examples

curl --request GET \
  --url 'https://your-domain.com/api/permisos/mis-permisos/2' \
  --cookie 'auth_token=<your-jwt>'

// Called automatically by useAuth at login time
const cargarMisPermisos = async (idPerfil: number) => {
  const response = await fetch(`/api/permisos/mis-permisos/${idPerfil}`);
  const data = await response.json();
  if (data.success) {
    misPermisos.value = data.permisos; // Record<string, PermisosAccion>
  }
};

// Manual call
const response = await fetch('/api/permisos/mis-permisos/2', {
  credentials: 'include',
});

const { success, permisos } = await response.json();

Success response

The response key permisos is a plain object — not an array. Each key is the module name in uppercase exactly as stored in the modulo table.

200

{
  "success": true,
  "permisos": {
    "USUARIO": {
      "nombreModulo": "Usuario",
      "bitAgregar": false,
      "bitEditar": true,
      "bitConsulta": true,
      "bitEliminar": false,
      "bitDetalle": true
    },
    "PERFIL": {
      "nombreModulo": "Perfil",
      "bitAgregar": false,
      "bitEditar": false,
      "bitConsulta": true,
      "bitEliminar": false,
      "bitDetalle": false
    },
    "MODULO": {
      "nombreModulo": "Modulo",
      "bitAgregar": false,
      "bitEditar": false,
      "bitConsulta": true,
      "bitEliminar": false,
      "bitDetalle": false
    }
  }
}

Each value object includes nombreModulo because the server selects it from the modulo join alongside the permission flags. Only the boolean flag fields are used by tienePermiso(); nombreModulo is informational.

Authentication

Users

Profiles

Modules

Permissions

Path parameters

Response

`PermisosAccion` interface

Error response

Examples

Success response

​Path parameters

​Response

​PermisosAccion interface

​Error response

​Examples

​Success response

Path parameters

Response

`PermisosAccion` interface

Error response

Examples

Success response