public
anord
read
Ledger
Why work hard when you can work easier?
Languages
Repository composition by tracked source files.
TypeScript
86%
CSS
10%
SQL
3%
Shell
1%
HTML
0%
Trace
packages/shared/src/rbac.ts
Trace helps you understand code history line by line. See who changed each line, when it changed, and which commit introduced it.
Author
Date
Commit
Line
Code
1
import type { RoleKey, SessionUser, Visibility } from "./contracts";
3
const roleWeight: Record<RoleKey, number> = {
4
public: 0,
5
viewer: 1,
6
editor: 2,
7
admin: 3,
8
owner: 4
9
};
11
export function hasRole(user: SessionUser | null, required: RoleKey): boolean {
12
const current = user?.role ?? "public";
13
return roleWeight[current] >= roleWeight[required];
14
}
16
export function canReadVisibility(
17
user: SessionUser | null,
18
visibility: Visibility,
19
allowedRoles: RoleKey[] = [],
20
allowedGroupIds: string[] = []
21
): boolean {
22
if (visibility === "public") {
23
return true;
24
}
26
if (!user) {
27
return false;
28
}
30
if (visibility === "internal") {
31
return hasRole(user, "viewer");
32
}
34
if (hasRole(user, "admin")) {
35
return true;
36
}
38
if (allowedRoles.length === 0 && allowedGroupIds.length === 0) {
39
return false;
40
}
42
const roleAllowed =
43
allowedRoles.length === 0 || allowedRoles.some((role) => hasRole(user, role));
44
const groupAllowed =
45
allowedGroupIds.length === 0 ||
46
allowedGroupIds.some((groupId) => user.groupIds.includes(groupId));
48
return roleAllowed && groupAllowed;
49
}
51
export function canEditPage(user: SessionUser | null): boolean {
52
return hasRole(user, "editor");
53
}
55
export function canManageSettings(user: SessionUser | null): boolean {
56
return hasRole(user, "admin");
57
}