# User Authentication + RBAC Implementation

## Current Status
- [x] Analyzed existing code/DB
- [x] Plan confirmed by user

## Steps
1. [x] Update db/montrade.sql: Fixed duplicate PRIMARY KEY in user_permissions, added default admin permissions
2. [x] Extend api/db.php: Added grantDefaultPermissions(), updateUserRole(), deleteUser()
3. [x] Create api/auth.php: register, login, approve, block, role, permissions endpoints + JWT middleware + RBAC guards
4. [x] Secure existing APIs (accounts.php, command.php, admin_command.php, report.php) with auth guards - fixed $config bug
5. [x] Frontend: Bootstrap 5.3 responsive - login.php, register.php, dashboard.php, admin/index.php
6. [x] JWT lib already installed (firebase/php-jwt)
7. [ ] Test full flow

## RBAC Roles
- **admin**: Full access to all resources (accounts, commands, reports, users) with all actions
- **operator**: Read/write accounts & commands, read/write reports, read users
- **member**: Read-only accounts & reports