lorentz
1112a06afe
- RMM Overshell (migration 077): admin page, dispatch UI, executor/worker, target resolver, script registry (AD/DHCP/DNS/event-log/services/software/network/loglift) - LogLift evidence pipeline (migration 078): upload webhook, B2 storage client, receiver/matcher, EventLogCollector PowerShell script - IT Glue audit + write-back (migrations 075, 076): asset-audit runner, ticket xrefs, applications/configurations browse pages + apply/revert/audit endpoints - Link-aware analyzer bundles (migration 073) + provider toggle (migration 074): link-discovery service, OpenRouter LLM provider, related-tickets/itglue-suggestion panels, analyze-bundle endpoint - Endpoint data model + device-link reconciliation (migrations 079, 080): conflicts admin page, reconciler service, resolve endpoints - Dashboard overhaul: integration-health service + alerts, overview/health endpoints - Permissions: add itglue + rmm scopes; middleware: public /api/rmm/loglift route Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
109 lines
2.9 KiB
TypeScript
109 lines
2.9 KiB
TypeScript
import { createAccessControl } from "better-auth/plugins/access";
|
|
|
|
// Define all available permissions for resources
|
|
export const statement = {
|
|
// Ticket management
|
|
tickets: ["create", "read", "update", "delete"],
|
|
|
|
// Configuration items
|
|
configItems: ["create", "read", "update", "delete"],
|
|
|
|
// Admin panel access
|
|
admin: ["access"],
|
|
|
|
// User management
|
|
users: ["create", "read", "update", "delete", "invite", "ban"],
|
|
|
|
// Role management
|
|
roles: ["create", "read", "update", "delete"],
|
|
|
|
// Audit log access
|
|
auditLog: ["read"],
|
|
|
|
// Settings management
|
|
settings: ["read", "update"],
|
|
|
|
// IT Glue documentation read/write (Phase 4 — asset audit + write-back)
|
|
itglue: ["read", "write"],
|
|
|
|
// Datto RMM Overshell evidence (Phase 4.2 — read jobs / execute scripts)
|
|
rmm: ["read", "execute"],
|
|
} as const;
|
|
|
|
// Create access control instance
|
|
export const ac = createAccessControl(statement);
|
|
|
|
// Super Admin role - full access to everything
|
|
export const superAdminRole = ac.newRole({
|
|
tickets: ["create", "read", "update", "delete"],
|
|
configItems: ["create", "read", "update", "delete"],
|
|
admin: ["access"],
|
|
users: ["create", "read", "update", "delete", "invite", "ban"],
|
|
roles: ["create", "read", "update", "delete"],
|
|
auditLog: ["read"],
|
|
settings: ["read", "update"],
|
|
itglue: ["read", "write"],
|
|
rmm: ["read", "execute"],
|
|
});
|
|
|
|
// Admin role - access to admin panel and user management, but not role management
|
|
export const adminRole = ac.newRole({
|
|
tickets: ["create", "read", "update", "delete"],
|
|
configItems: ["create", "read", "update", "delete"],
|
|
admin: ["access"],
|
|
users: ["create", "read", "update", "invite"],
|
|
roles: ["read"],
|
|
auditLog: ["read"],
|
|
settings: ["read"],
|
|
itglue: ["read", "write"],
|
|
rmm: ["read", "execute"],
|
|
});
|
|
|
|
// User role - basic access
|
|
export const userRole = ac.newRole({
|
|
tickets: ["create", "read", "update"],
|
|
configItems: ["read"],
|
|
admin: [],
|
|
users: [],
|
|
roles: [],
|
|
auditLog: [],
|
|
settings: [],
|
|
itglue: ["read"],
|
|
rmm: ["read"],
|
|
});
|
|
|
|
// Helper function to check if a user has a specific permission
|
|
export function hasPermission(
|
|
userRole: string,
|
|
resource: keyof typeof statement,
|
|
action: string
|
|
): boolean {
|
|
const roles: Record<string, ReturnType<typeof ac.newRole>> = {
|
|
"super-admin": superAdminRole,
|
|
admin: adminRole,
|
|
user: userRole as unknown as ReturnType<typeof ac.newRole>,
|
|
};
|
|
|
|
const role = roles[userRole];
|
|
if (!role) return false;
|
|
|
|
// Check if the role has the permission
|
|
const permissions = role.statements[resource];
|
|
if (!permissions) return false;
|
|
|
|
return (permissions as readonly string[]).includes(action);
|
|
}
|
|
|
|
// Type for permission check
|
|
export type Permission = {
|
|
resource: keyof typeof statement;
|
|
action: string;
|
|
};
|
|
|
|
// Check multiple permissions
|
|
export function hasPermissions(
|
|
userRole: string,
|
|
permissions: Permission[]
|
|
): boolean {
|
|
return permissions.every((p) => hasPermission(userRole, p.resource, p.action));
|
|
}
|