Technical Security Specification
Document Status: Core Engine & Tenancy Blueprint • May 2026
This document defines the security parameters, data boundaries, and Role-Based Access Control (RBAC) mechanics running natively within the LabelPro Canvas Designer Engine and its segmented location architecture. The application uses an architectural isolation strategy: design templates and operational permissions are audited on the cloud backend, while live canvas printing variables remain entirely local to the user's active workstation viewport.
The designer engine separates layout assets from the active variable datasets loaded into the designer grid.
executeClearCanvas) that completely destroys all runtime canvas variables, text objects, and high-density barcodes across the rendering space — reverting memory nodes to a clean state without leaving temporary trace files on disk.calibrationData.x, calibrationData.y, and scale configurations) are managed as local, isolated parameters. These variables alter print-head coordinates locally, preventing physical infrastructure specs from being exposed or altered by external network tenants.System access rules are enforced at both the UI layer and database row level using a multi-tiered hierarchy: owner, it_admin, admin, and member.
| Permission Vector | Owner / IT Admin | Floor Admin | Member |
|---|---|---|---|
| Cloud Template Creation | Unrestricted (global or per warehouse) | Restricted to assigned warehouse ID | Blocked — no cloud saves |
| Global Warehouse Visibility | Full — any facility location | Locked to assigned facility | No location visibility |
| Template Erasure | Unrestricted (global or local) | Own warehouse only | Blocked |
| Disk Operations | Export / backup configurations | Export configurations | Gated by active subscription — not role-based |
To prevent cross-site contamination within large enterprise operations, the engine uses strict multi-warehouse indexing rules.
canSave), not by role. A member with an active subscription can write to cloud storage. Role enforcement governs template visibility and deletion — not the save action itself.Only owner or it_admin roles can access the Global View dropdown. Standard branch managers (admin) are scoped exclusively to their facility, ensuring regional workflows cannot intercept layout structures from other hubs.
When saving a layout, elevated roles can assign it to a specific branch or promote it to a system-wide Global Master Template. For floor employees, the routing menu is entirely locked down, displaying only a read-only token of their corporate myWarehouseId.
Authorised personnel can flag critical configurations as a Master Template. Once set, an is_master flag is applied — visually badging the asset in the library and programmatically blocking standard operator access.
if (
userRole === 'owner' ||
userRole === 'it_admin' ||
(userRole === 'admin' && tpl.warehouse_id === myWarehouseId)
) {
// Proceed to execute template destruction sequence securely
}This guard operates at the UI layer — the delete button is not rendered for unauthorised roles. The underlying deleteTemplateFromDB function contains no additional role check; backend enforcement is delegated to Supabase Row Level Security (RLS) policies on the templates table.
For security enquiries: info@barcodecanvas.com