server/boot/01-setup.js
function getUserAppRoles(app, usrId, uroFor, uroForId, cb) {
  var zlUserRole = app.models.zlUserRole;
  let filter = {
    where: {usrId: usrId, uroFor: uroFor, uroForId: uroForId}
  };
  zlUserRole.findOne( filter, (err, data) => {
    if (data && data.uroRoles) {
      let allRoles = buildAllRoles([], data.uroRoles);
      cb(allRoles);
    }
    else if ('Network' !== uroFor) {
      // check if user has network role that inherits this role globally
      getUserAppRoles(app, usrId, 'Network', 0, cb);
    }
    else cb();
  });
}
function getUserAppRoles(app, usrId, uroFor, uroForId, cb) {
  var zlUserRole = app.models.zlUserRole;
  let filter = {
    where: {usrId: usrId, uroFor: uroFor, uroForId: uroForId}
  };
  zlUserRole.findOne( filter, (err, data) => {
    if (data && data.uroRoles) {
      let allRoles = buildAllRoles([], data.uroRoles);
      cb(allRoles);
    }
    else if ('Network' !== uroFor) {
      // check if user has network role that inherits this role globally
      getUserAppRoles(app, usrId, 'Network', 0, cb);
    }
    else cb();
  });
}
get site roles for user TODO: save user's roles to cache for quicker request access