# GymFlow Mobile App — Permission Matrix (MVP)

This corrects the spec's original matrix (§36) against the real schema:
`staff_role` has no "Administrator" role, and web back-office logins
(`users` table) are a separate, unrelated system. Per the user's decision:

- **Mobile Trainer eligibility** = `staff` row whose `staff_role.roleType = 'Service Staff'`
  (covers `Trainer` and `Freelance Trainer`).
- **Mobile Admin eligibility** = `staff` row whose `staff_role.role = 'Administration'`
  specifically (not all `Operational Staff` — excludes Accountant, Sweeper,
  Cleaner, Guard, Receptionist, Ball Boy). Admin signup is invite-only
  (`mobile_account_invitations`), issued by an existing web `users` admin.
- **Mobile Member eligibility** = a `members` row matched by normalized contact.

A person can hold both a Trainer and an Admin `mobile_users` identity only if
they have two distinct linked `staff` rows satisfying each rule respectively —
these remain two separate mobile accounts/logins (spec §6.7); no automatic
elevation.

## Capability matrix

| Capability | Member | Trainer | Admin |
|---|---:|---:|---:|
| View feed | Yes | Yes | Yes |
| Create normal post (text/image) | Yes | Yes | Yes |
| Create gym notice | No | No | Yes |
| Delete own post | Yes | Yes | Yes |
| Delete/hide any post | No | No | Yes |
| Report post | Yes | Yes | Yes |
| Review/resolve content reports | No | No | Yes |
| View own membership | Yes | No | No |
| Upload renewal proof | Yes | No | No |
| Approve/reject renewal request | No | No | Yes |
| View own progress/measurements | Yes | No | No |
| Add own measurement | Yes | No | No |
| View linked members | No | Yes | No |
| Add linked-member measurement | No | Yes | Yes (web only, not in mobile MVP) |
| Add trainer note on linked member | No | Yes | No (view only, per §16) |
| Create plan templates | No | Yes | No (web only, later phase) |
| Assign plans to eligible members | No | Yes | No (web only, later phase) |
| View own trainer payments | No | Yes | No |
| View today's attendance | Own check-in only | Own check-in only | All branch attendance |
| View daily financials / closing | No | No | Yes (read-only in MVP) |
| Send push notification | No | No | Yes |
| Manage mobile accounts (lock/block/revoke) | No | No | Web portal only (out of MVP mobile scope) |
| Store catalogue (read) | Yes | Yes | Yes |

## Branch scoping rule (applies to every row above)

Every request is scoped to `X-Branch-ID`, validated against
`mobile_user_links` for the authenticated `mobile_user_id` before any query
runs. A Trainer/Admin with links to branches 1 and 2 cannot read or write
branch 3 data even if they guess a valid ID — the middleware rejects it with
`403 FORBIDDEN` before the controller runs, per spec §41 (branch validation
before role authorization before request validation).

## Deferred to a later phase (not covered here)

Partner finder permissions, comment permissions, and plan-completion-tracking
permissions are out of MVP scope per spec §50 and are intentionally omitted
from this matrix — they'll get their own matrix section when that phase starts.