From 04ec51f370d7fec320069b5fc0c7b6345aab5941 Mon Sep 17 00:00:00 2001
From: lorentz <lorentz@wulfconsulting.com>
Date: Wed, 15 Jul 2026 19:23:09 -0400
Subject: [PATCH] feat(18-01): add phishing permission resource + role grants

- statement gets the full D-05 vocabulary now: read/analyze/approve/remediate
- superAdminRole and adminRole grant read+analyze
- userRole grants read only (cannot trigger /analyze)
- approve/remediate declared but ungranted to any role until Phase 20
---
 lib/permissions.ts | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/lib/permissions.ts b/lib/permissions.ts
index c11d963..a1a3e3b 100644
--- a/lib/permissions.ts
+++ b/lib/permissions.ts
@@ -28,6 +28,10 @@ export const statement = {
 
   // Datto RMM Overshell evidence (Phase 4.2 — read jobs / execute scripts)
   rmm: ["read", "execute"],
+
+  // Phishing triage campaigns/reports (Phase 18 — D-05: full vocabulary now;
+  // approve/remediate ungranted to any role until Phase 20)
+  phishing: ["read", "analyze", "approve", "remediate"],
 } as const;
 
 // Create access control instance
@@ -44,6 +48,7 @@ export const superAdminRole = ac.newRole({
   settings: ["read", "update"],
   itglue: ["read", "write"],
   rmm: ["read", "execute"],
+  phishing: ["read", "analyze"], // approve/remediate ungranted until Phase 20
 });
 
 // Admin role - access to admin panel and user management, but not role management
@@ -57,6 +62,7 @@ export const adminRole = ac.newRole({
   settings: ["read"],
   itglue: ["read", "write"],
   rmm: ["read", "execute"],
+  phishing: ["read", "analyze"],
 });
 
 // User role - basic access
@@ -70,6 +76,7 @@ export const userRole = ac.newRole({
   settings: [],
   itglue: ["read"],
   rmm: ["read"],
+  phishing: ["read"], // cannot trigger /analyze
 });
 
 // Helper function to check if a user has a specific permission