wulf-pulse/lib/permissions.ts

import { createAccessControl } from "better-auth/plugins/access";

// Define all available permissions for resources
export const statement = {
  // Ticket management
  tickets: ["create", "read", "update", "delete"],
  
  // Configuration items
  configItems: ["create", "read", "update", "delete"],
  
  // Admin panel access
  admin: ["access"],
  
  // User management
  users: ["create", "read", "update", "delete", "invite", "ban"],
  
  // Role management
  roles: ["create", "read", "update", "delete"],
  
  // Audit log access
  auditLog: ["read"],
  
  // Settings management
  settings: ["read", "update"],

  // IT Glue documentation read/write (Phase 4 — asset audit + write-back)
  itglue: ["read", "write"],

  // Datto RMM Overshell evidence (Phase 4.2 — read jobs / execute scripts)
  rmm: ["read", "execute"],

  // Phishing triage campaigns/reports (Phase 18 — D-05: full vocabulary)
  phishing: ["read", "analyze", "approve", "remediate"],
} as const;

// Create access control instance
export const ac = createAccessControl(statement);

// Super Admin role - full access to everything
export const superAdminRole = ac.newRole({
  tickets: ["create", "read", "update", "delete"],
  configItems: ["create", "read", "update", "delete"],
  admin: ["access"],
  users: ["create", "read", "update", "delete", "invite", "ban"],
  roles: ["create", "read", "update", "delete"],
  auditLog: ["read"],
  settings: ["read", "update"],
  itglue: ["read", "write"],
  rmm: ["read", "execute"],
  phishing: ["read", "analyze", "approve", "remediate"],
});

// Admin role - access to admin panel and user management, but not role management
export const adminRole = ac.newRole({
  tickets: ["create", "read", "update", "delete"],
  configItems: ["create", "read", "update", "delete"],
  admin: ["access"],
  users: ["create", "read", "update", "invite"],
  roles: ["read"],
  auditLog: ["read"],
  settings: ["read"],
  itglue: ["read", "write"],
  rmm: ["read", "execute"],
  phishing: ["read", "analyze", "approve", "remediate"],
});

// User role - basic access
export const userRole = ac.newRole({
  tickets: ["create", "read", "update"],
  configItems: ["read"],
  admin: [],
  users: [],
  roles: [],
  auditLog: [],
  settings: [],
  itglue: ["read"],
  rmm: ["read"],
  phishing: ["read"], // cannot trigger /analyze
});

// Helper function to check if a user has a specific permission
export function hasPermission(
  roleName: string,
  resource: keyof typeof statement,
  action: string
): boolean {
  const roles: Record<string, ReturnType<typeof ac.newRole>> = {
    "super-admin": superAdminRole,
    admin: adminRole,
    user: userRole,
  };

  const role = roles[roleName];
  if (!role) return false;

  // Check if the role has the permission
  const permissions = role.statements[resource];
  if (!permissions) return false;

  return (permissions as readonly string[]).includes(action);
}

// Type for permission check
export type Permission = {
  resource: keyof typeof statement;
  action: string;
};

// Check multiple permissions
export function hasPermissions(
  userRole: string,
  permissions: Permission[]
): boolean {
  return permissions.every((p) => hasPermission(userRole, p.resource, p.action));
}