Any idea about multi-user rights in SPA applications?

Question

Web development

The essence of the question is this:
There are SPA applications in VueJs. And the backend in Yii2. It is necessary to make sure that the admin has the opportunity to give rights as a moderator in any part of the admin panel.
For example, there is a list of rights
Users
- List of users
- Add user
- Edit user
- Delete user
- etc.

There was an idea ...
I send route.name to the backend when requesting and there I check for rights. but this idea doesn't work very well.

[
  "user_create" => ["api/user/create", "api/user/options"]
];

Answer 1

Well, kakbe enterprise is usually a system: micro-roles - roles - positions (sets of roles). The first is permission to a certain sneeze in a certain direction within the application, the second is a set of the first connected by some logic, the third is a set of the second connected by the authorities. The user is accordingly assigned the third one, and the first one is checked inside the application.
If you cut on your knee, you can not take a steam bath and use a single-level system in which you simply assign roles to the user and check them immediately in the application. Take the list of available roles when logging in.
Roles are in no way tied to the structure of the application and have self-explanatory names.

Answer 2

I would make a rights check function on the front, which, in fact, will contact the backend and pull $user->can already. With caching of course.
And on the front you can also manipulate permissions like you did in php views. async/await will allow you to wait for a response.