vulkro rbac

Prints a matrix of which login level each endpoint requires.

vulkro rbac .                     # Markdown table
vulkro rbac . --format json -o rbac.json

Rows are endpoints. Columns are the auth tiers Anonymous, User, Admin, Service, Machine and Unknown, plus scopes and tenant scoping. Tiers come from decorators and middleware such as @UseGuards(AdminGuard), IsAdminUser, @PreAuthorize("hasRole('ADMIN')") or a RequireAdmin middleware. When there is no clear evidence the tier is Unknown; it is never guessed.

| Method | Path                   | Anonymous | User | Admin | Scopes      | Tenant    |
|--------|------------------------|:---------:|:----:|:-----:|-------------|-----------|
| GET    | /api/health            |     x     |      |       |             | global    |
| POST   | /api/users/:id/promote |           |      |   x   | users:admin | by tenant |

Use it for audit handoff ("which endpoints can role X reach?"), to diff before and after a release, and to spot endpoints in a multi-tenant app that do not scope by tenant.

Flags

Flag	Description
--format <FORMAT>	md (default) or json.
-o, --output <FILE>	Write to a file instead of stdout.

Exit codes

0 matrix written. 2 scan or IO error. It never returns 1.

See also: vulkro openapi, vulkro discover.