lorentz
80e7129740
- superAdminRole and adminRole now include "approve" and "remediate" for phishing - userRole unchanged (still read-only)
115 lines
3.2 KiB
TypeScript
115 lines
3.2 KiB
TypeScript
import { createAccessControl } from "better-auth/plugins/access";
|
|
|
|
// Define all available permissions for resources
|
|
export const statement = {
|
|
// Ticket management
|
|
tickets: ["create", "read", "update", "delete"],
|
|
|
|
// Configuration items
|
|
configItems: ["create", "read", "update", "delete"],
|
|
|
|
// Admin panel access
|
|
admin: ["access"],
|
|
|
|
// User management
|
|
users: ["create", "read", "update", "delete", "invite", "ban"],
|
|
|
|
// Role management
|
|
roles: ["create", "read", "update", "delete"],
|
|
|
|
// Audit log access
|
|
auditLog: ["read"],
|
|
|
|
// Settings management
|
|
settings: ["read", "update"],
|
|
|
|
// IT Glue documentation read/write (Phase 4 — asset audit + write-back)
|
|
itglue: ["read", "write"],
|
|
|
|
// Datto RMM Overshell evidence (Phase 4.2 — read jobs / execute scripts)
|
|
rmm: ["read", "execute"],
|
|
|
|
// Phishing triage campaigns/reports (Phase 18 — D-05: full vocabulary)
|
|
phishing: ["read", "analyze", "approve", "remediate"],
|
|
} as const;
|
|
|
|
// Create access control instance
|
|
export const ac = createAccessControl(statement);
|
|
|
|
// Super Admin role - full access to everything
|
|
export const superAdminRole = ac.newRole({
|
|
tickets: ["create", "read", "update", "delete"],
|
|
configItems: ["create", "read", "update", "delete"],
|
|
admin: ["access"],
|
|
users: ["create", "read", "update", "delete", "invite", "ban"],
|
|
roles: ["create", "read", "update", "delete"],
|
|
auditLog: ["read"],
|
|
settings: ["read", "update"],
|
|
itglue: ["read", "write"],
|
|
rmm: ["read", "execute"],
|
|
phishing: ["read", "analyze", "approve", "remediate"],
|
|
});
|
|
|
|
// Admin role - access to admin panel and user management, but not role management
|
|
export const adminRole = ac.newRole({
|
|
tickets: ["create", "read", "update", "delete"],
|
|
configItems: ["create", "read", "update", "delete"],
|
|
admin: ["access"],
|
|
users: ["create", "read", "update", "invite"],
|
|
roles: ["read"],
|
|
auditLog: ["read"],
|
|
settings: ["read"],
|
|
itglue: ["read", "write"],
|
|
rmm: ["read", "execute"],
|
|
phishing: ["read", "analyze", "approve", "remediate"],
|
|
});
|
|
|
|
// User role - basic access
|
|
export const userRole = ac.newRole({
|
|
tickets: ["create", "read", "update"],
|
|
configItems: ["read"],
|
|
admin: [],
|
|
users: [],
|
|
roles: [],
|
|
auditLog: [],
|
|
settings: [],
|
|
itglue: ["read"],
|
|
rmm: ["read"],
|
|
phishing: ["read"], // cannot trigger /analyze
|
|
});
|
|
|
|
// Helper function to check if a user has a specific permission
|
|
export function hasPermission(
|
|
roleName: string,
|
|
resource: keyof typeof statement,
|
|
action: string
|
|
): boolean {
|
|
const roles: Record<string, ReturnType<typeof ac.newRole>> = {
|
|
"super-admin": superAdminRole,
|
|
admin: adminRole,
|
|
user: userRole,
|
|
};
|
|
|
|
const role = roles[roleName];
|
|
if (!role) return false;
|
|
|
|
// Check if the role has the permission
|
|
const permissions = role.statements[resource];
|
|
if (!permissions) return false;
|
|
|
|
return (permissions as readonly string[]).includes(action);
|
|
}
|
|
|
|
// Type for permission check
|
|
export type Permission = {
|
|
resource: keyof typeof statement;
|
|
action: string;
|
|
};
|
|
|
|
// Check multiple permissions
|
|
export function hasPermissions(
|
|
userRole: string,
|
|
permissions: Permission[]
|
|
): boolean {
|
|
return permissions.every((p) => hasPermission(userRole, p.resource, p.action));
|
|
}
|