9f912aed24
Added comprehensive authentication and authorization system: Authentication System: - Better Auth integration with session management - Login/logout pages and API routes - Middleware for route protection - Auth utilities and client libraries User Management: - User list, detail, and invite pages - User API endpoints (CRUD operations) - Session management for users - Profile settings page Role-Based Access Control: - Role management pages (list, create, edit) - Permission system with granular controls - Role assignment to users - Role API endpoints Admin Features: - Audit log page for tracking system events - Admin settings page - Audit service for logging user actions Additional Features: - Quotes management pages and components - SalesBldr API integration - Email service for notifications Configuration & Documentation: - Updated docker-compose.yml - MCP server configuration (mcp.json) - CVE-2025-55182 security review documentation - Standards guide and PRD documents - Re-enabling authentication documentation Database Migrations: - 012: Auth tables (users, sessions, accounts, verifications) - 013: Role tables (roles, permissions, role_permissions, user_roles) - 014: Admin settings table UI Updates: - Updated dashboard layout - Enhanced app layout with auth integration
97 lines
2.6 KiB
TypeScript
97 lines
2.6 KiB
TypeScript
import { createAccessControl } from "better-auth/plugins/access";
|
|
|
|
// Define all available permissions for resources
|
|
export const statement = {
|
|
// Ticket management
|
|
tickets: ["create", "read", "update", "delete"],
|
|
|
|
// Configuration items
|
|
configItems: ["create", "read", "update", "delete"],
|
|
|
|
// Admin panel access
|
|
admin: ["access"],
|
|
|
|
// User management
|
|
users: ["create", "read", "update", "delete", "invite", "ban"],
|
|
|
|
// Role management
|
|
roles: ["create", "read", "update", "delete"],
|
|
|
|
// Audit log access
|
|
auditLog: ["read"],
|
|
|
|
// Settings management
|
|
settings: ["read", "update"],
|
|
} as const;
|
|
|
|
// Create access control instance
|
|
export const ac = createAccessControl(statement);
|
|
|
|
// Super Admin role - full access to everything
|
|
export const superAdminRole = ac.newRole({
|
|
tickets: ["create", "read", "update", "delete"],
|
|
configItems: ["create", "read", "update", "delete"],
|
|
admin: ["access"],
|
|
users: ["create", "read", "update", "delete", "invite", "ban"],
|
|
roles: ["create", "read", "update", "delete"],
|
|
auditLog: ["read"],
|
|
settings: ["read", "update"],
|
|
});
|
|
|
|
// Admin role - access to admin panel and user management, but not role management
|
|
export const adminRole = ac.newRole({
|
|
tickets: ["create", "read", "update", "delete"],
|
|
configItems: ["create", "read", "update", "delete"],
|
|
admin: ["access"],
|
|
users: ["create", "read", "update", "invite"],
|
|
roles: ["read"],
|
|
auditLog: ["read"],
|
|
settings: ["read"],
|
|
});
|
|
|
|
// User role - basic access
|
|
export const userRole = ac.newRole({
|
|
tickets: ["create", "read", "update"],
|
|
configItems: ["read"],
|
|
admin: [],
|
|
users: [],
|
|
roles: [],
|
|
auditLog: [],
|
|
settings: [],
|
|
});
|
|
|
|
// Helper function to check if a user has a specific permission
|
|
export function hasPermission(
|
|
userRole: string,
|
|
resource: keyof typeof statement,
|
|
action: string
|
|
): boolean {
|
|
const roles: Record<string, ReturnType<typeof ac.newRole>> = {
|
|
"super-admin": superAdminRole,
|
|
admin: adminRole,
|
|
user: userRole as unknown as ReturnType<typeof ac.newRole>,
|
|
};
|
|
|
|
const role = roles[userRole];
|
|
if (!role) return false;
|
|
|
|
// Check if the role has the permission
|
|
const permissions = role.statements[resource];
|
|
if (!permissions) return false;
|
|
|
|
return (permissions as readonly string[]).includes(action);
|
|
}
|
|
|
|
// Type for permission check
|
|
export type Permission = {
|
|
resource: keyof typeof statement;
|
|
action: string;
|
|
};
|
|
|
|
// Check multiple permissions
|
|
export function hasPermissions(
|
|
userRole: string,
|
|
permissions: Permission[]
|
|
): boolean {
|
|
return permissions.every((p) => hasPermission(userRole, p.resource, p.action));
|
|
}
|