shridarpatil
diff --git a/‎.github/workflows/test.yml‎
Lines changed: 2 additions & 1 deletion b/‎.github/workflows/test.yml‎
Lines changed: 2 additions & 1 deletion
diff --git a/‎.gitignore‎
Lines changed: 3 additions & 0 deletions b/‎.gitignore‎
Lines changed: 3 additions & 0 deletions
diff --git a/‎README.md‎
Lines changed: 3 additions & 3 deletions b/‎README.md‎
Lines changed: 3 additions & 3 deletions
diff --git a/‎cmd/whatomate/main.go‎
Lines changed: 15 additions & 64 deletions b/‎cmd/whatomate/main.go‎
Lines changed: 15 additions & 64 deletions
diff --git a/‎docs/astro.config.mjs‎
Lines changed: 2 additions & 0 deletions b/‎docs/astro.config.mjs‎
Lines changed: 2 additions & 0 deletions
@@ -56,7 +56,8 @@ jobs:
           TEST_REDIS_URL: redis://localhost:6379
         run: |
           # Run tests with coverage, excluding test utility packages from coverage calculation
-          go test -v -race -coverprofile=coverage.out $(go list ./... | grep -v /test/)
+          # -p 1 runs packages sequentially to avoid database conflicts (all packages share the test DB)
+          go test -v -race -p 1 -coverprofile=coverage.out $(go list ./... | grep -v /test/)
 
       - name: Display coverage
         run: go tool cover -func=coverage.out | grep "total:"
 
@@ -53,3 +53,6 @@ logs/
 tmp/
 temp/
 uploads/
+
+# Test results
+test-results/
@@ -11,8 +11,8 @@ Modern, open-source WhatsApp Business Platform. Single binary app.
 - **Multi-tenant Architecture**
   Support multiple organizations with isolated data and configurations.
 
-- **Role-Based Access Control**
-  Three roles (Admin, Manager, Agent) with granular permissions.
+- **Granular Roles & Permissions**
+  Customizable roles with fine-grained permissions. Create custom roles, assign specific permissions per resource (users, contacts, templates, etc.), and control access at the action level (read, create, update, delete). Super admins can manage multiple organizations.
 
 - **WhatsApp Cloud API Integration**
   Connect with Meta's WhatsApp Business API for messaging.
@@ -94,7 +94,7 @@ make build-prod
 ./whatomate server -migrate
 ```
 
-See [configuration docs](docs/src/content/docs/getting-started/configuration.mdx) for detailed setup options.
+See [configuration docs](https://shridarpatil.github.io/whatomate/getting-started/configuration/) for detailed setup options.
 
 ## CLI Usage
 
 
@@ -14,7 +14,6 @@ import (
 	"github.com/shridarpatil/whatomate/internal/frontend"
 	"github.com/shridarpatil/whatomate/internal/handlers"
 	"github.com/shridarpatil/whatomate/internal/middleware"
-	"github.com/shridarpatil/whatomate/internal/models"
 	"github.com/shridarpatil/whatomate/internal/queue"
 	"github.com/shridarpatil/whatomate/internal/websocket"
 	"github.com/shridarpatil/whatomate/internal/worker"
@@ -432,68 +431,8 @@ func setupRoutes(g *fastglue.Fastglue, app *handlers.App, lo logf.Logger, basePa
 			return r
 		}
 
-		path := string(r.RequestCtx.Path())
-
-		// Only apply to authenticated API routes
-		if len(path) < 4 || path[:4] != "/api" {
-			return r
-		}
-
-		// Get role from context (set by auth middleware)
-		role, ok := r.RequestCtx.UserValue("role").(models.Role)
-		if !ok {
-			return r // Auth middleware will handle unauthenticated requests
-		}
-
-		// Admin-only routes: user management, API keys, and SSO settings
-		if (len(path) >= 10 && path[:10] == "/api/users") ||
-			(len(path) >= 13 && path[:13] == "/api/api-keys") ||
-			(len(path) >= 17 && path[:17] == "/api/settings/sso") {
-			if role != models.RoleAdmin {
-				r.RequestCtx.SetStatusCode(403)
-				r.RequestCtx.SetBodyString(`{"status":"error","message":"Admin access required"}`)
-				return nil
-			}
-		}
-
-		// Manager+ routes: agents cannot access these
-		if role == models.RoleAgent {
-			// Agent-accessible exceptions under restricted prefixes
-			agentAllowedPaths := []string{
-				"/api/chatbot/transfers",
-				"/api/analytics/agents",
-			}
-
-			isAllowed := false
-			for _, allowed := range agentAllowedPaths {
-				if len(path) >= len(allowed) && path[:len(allowed)] == allowed {
-					isAllowed = true
-					break
-				}
-			}
-
-			if !isAllowed {
-				managerRoutes := []string{
-					"/api/accounts",
-					"/api/templates",
-					"/api/flows",
-					"/api/campaigns",
-					"/api/chatbot",
-					"/api/analytics",
-				}
-				for _, prefix := range managerRoutes {
-					if len(path) >= len(prefix) && path[:len(prefix)] == prefix {
-						r.RequestCtx.SetStatusCode(403)
-						r.RequestCtx.SetBodyString(`{"status":"error","message":"Access denied"}`)
-						return nil
-					}
-				}
-			}
-
-			// Agents can only create contacts, not modify/delete
-			// PUT and DELETE for contacts are allowed if it's their assigned contact (checked in handler)
-		}
-
+		// Route-level permission checks are now handled at the handler level
+		// using the granular permission system (HasPermission checks)
 		return r
 	})
 
@@ -510,6 +449,14 @@ func setupRoutes(g *fastglue.Fastglue, app *handlers.App, lo logf.Logger, basePa
 	g.PUT("/api/users/{id}", app.UpdateUser)
 	g.DELETE("/api/users/{id}", app.DeleteUser)
 
+	// Roles & Permissions (admin only - enforced by middleware)
+	g.GET("/api/roles", app.ListRoles)
+	g.POST("/api/roles", app.CreateRole)
+	g.GET("/api/roles/{id}", app.GetRole)
+	g.PUT("/api/roles/{id}", app.UpdateRole)
+	g.DELETE("/api/roles/{id}", app.DeleteRole)
+	g.GET("/api/permissions", app.ListPermissions)
+
 	// API Keys (admin only - enforced by middleware)
 	g.GET("/api/api-keys", app.ListAPIKeys)
 	g.POST("/api/api-keys", app.CreateAPIKey)
@@ -649,6 +596,10 @@ func setupRoutes(g *fastglue.Fastglue, app *handlers.App, lo logf.Logger, basePa
 	g.GET("/api/org/settings", app.GetOrganizationSettings)
 	g.PUT("/api/org/settings", app.UpdateOrganizationSettings)
 
+	// Organizations (super admin only)
+	g.GET("/api/organizations", app.ListOrganizations)
+	g.GET("/api/organizations/current", app.GetCurrentOrganization)
+
 	// SSO Settings (admin only - enforced by middleware)
 	g.GET("/api/settings/sso", app.GetSSOSettings)
 	g.PUT("/api/settings/sso/{provider}", app.UpdateSSOProvider)
@@ -714,7 +665,7 @@ func corsWrapper(next fasthttp.RequestHandler) fasthttp.RequestHandler {
 
 		ctx.Response.Header.Set("Access-Control-Allow-Origin", origin)
 		ctx.Response.Header.Set("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS, PATCH")
-		ctx.Response.Header.Set("Access-Control-Allow-Headers", "Content-Type, Authorization, X-API-Key, X-Requested-With")
+		ctx.Response.Header.Set("Access-Control-Allow-Headers", "Content-Type, Authorization, X-API-Key, X-Requested-With, X-Organization-ID")
 		ctx.Response.Header.Set("Access-Control-Allow-Credentials", "true")
 		ctx.Response.Header.Set("Access-Control-Max-Age", "86400")
 
 
@@ -24,6 +24,7 @@ export default defineConfig({
           label: 'Features',
           items: [
             { label: 'Dashboard', slug: 'features/dashboard' },
+            { label: 'Roles & Permissions', slug: 'features/roles-permissions' },
             { label: 'Chatbot Automation', slug: 'features/chatbot' },
             { label: 'Canned Responses', slug: 'features/canned-responses' },
             { label: 'Templates', slug: 'features/templates' },
@@ -38,6 +39,7 @@ export default defineConfig({
             { label: 'Authentication', slug: 'api-reference/authentication' },
             { label: 'API Keys', slug: 'api-reference/api-keys' },
             { label: 'Users', slug: 'api-reference/users' },
+            { label: 'Roles', slug: 'api-reference/roles' },
             { label: 'Accounts', slug: 'api-reference/accounts' },
             { label: 'Contacts', slug: 'api-reference/contacts' },
             { label: 'Messages', slug: 'api-reference/messages' },