feat(door): P1 member access cards + door permissions
Migration 034 adds member_cards (RFID/NFC UID -> member). The card UID is treated as a credential: door.manage-only RLS with no member SELECT policy; the member's own "My access cards" view goes through a service -client action that returns only count + last4 (never the raw UID). New door.manage / door.operate permissions (group Access), seeded to board and backfilled, introduced now for the whole Door epic. Pure door-logic masking is unit-tested. A per-member "Cards" panel on /members is gated to door.manage (independent of admin). No controller calls and no anonymous path in this phase. Mirrored in schema.sql; types and schema docs updated.
This commit is contained in:
Moheeb Zara
+34
-1
@@ -8,7 +8,7 @@ import {
|
||||
type CertStatus,
|
||||
} from '@/lib/certifications-logic'
|
||||
import { PERMISSIONS, PERMISSION_CODES } from '@/lib/permissions-catalog'
|
||||
import { getMyClassSignups, getMyReservations } from '@/lib/actions'
|
||||
import { getMyClassSignups, getMyReservations, getMyCards } from '@/lib/actions'
|
||||
import { SIGNUP_STATUS_LABEL, SESSION_STATUS_LABEL } from '@/lib/classes-logic'
|
||||
import { RESERVATION_STATUS_LABEL } from '@/lib/equipment-logic'
|
||||
|
||||
@@ -103,6 +103,10 @@ export default async function MePage() {
|
||||
}
|
||||
const reservations: Reservation[] = 'data' in reservationRes ? (reservationRes.data as Reservation[]) : []
|
||||
const equipOf = (r: Reservation) => (Array.isArray(r.equipment) ? r.equipment[0] : r.equipment)
|
||||
|
||||
const cardsRes = await getMyCards()
|
||||
type MyCard = { id: string; card_type: string; label: string | null; is_active: boolean; last4: string }
|
||||
const myCards: MyCard[] = 'data' in cardsRes ? (cardsRes.data as MyCard[]) : []
|
||||
const titleOf = (cs: ClassSignup) => {
|
||||
const sess = sessionOf(cs)
|
||||
const c = sess ? (Array.isArray(sess.classes) ? sess.classes[0] : sess.classes) : null
|
||||
@@ -261,6 +265,35 @@ export default async function MePage() {
|
||||
</ul>
|
||||
)}
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<h2 className="font-mono text-[10px] uppercase tracking-widest text-muted-foreground mb-3">
|
||||
My access cards
|
||||
</h2>
|
||||
{myCards.length === 0 ? (
|
||||
<p className="font-sans text-sm text-muted-foreground">
|
||||
No access cards are registered to you. A door manager can add one.
|
||||
</p>
|
||||
) : (
|
||||
<ul className="divide-y rounded-lg border border-border">
|
||||
{myCards.map(c => (
|
||||
<li key={c.id} className="p-4 flex items-center justify-between gap-4">
|
||||
<div>
|
||||
<span className="font-mono text-sm text-foreground">•••• {c.last4}</span>
|
||||
<span className="font-mono text-[10px] text-muted-foreground ml-2 uppercase">{c.card_type}</span>
|
||||
{c.label && <span className="font-sans text-xs text-muted-foreground ml-2">{c.label}</span>}
|
||||
</div>
|
||||
<Badge variant={c.is_active ? 'default' : 'outline'}>
|
||||
{c.is_active ? 'Active' : 'Inactive'}
|
||||
</Badge>
|
||||
</li>
|
||||
))}
|
||||
</ul>
|
||||
)}
|
||||
<p className="font-sans text-xs text-muted-foreground mt-3">
|
||||
Only the last 4 digits are shown. The full card number is never displayed here.
|
||||
</p>
|
||||
</section>
|
||||
</div>
|
||||
</>
|
||||
)
|
||||
|
||||
@@ -11,6 +11,7 @@ import type { Tables } from '@/types/database'
|
||||
import { PageTitle } from '@/components/ui/page-title'
|
||||
import { useConfirm } from '@/components/ui/confirm'
|
||||
import { MemberCertificationsDialog } from '@/components/certifications/member-certifications-dialog'
|
||||
import { MemberCardsDialog } from '@/components/door/member-cards-dialog'
|
||||
|
||||
type Member = Tables<'space_members'>
|
||||
type AreaLeadRole = { id: string; area_name: string; lead_id: string | null }
|
||||
@@ -27,6 +28,9 @@ interface Props {
|
||||
// capability), independent of admin/board. Adds a per-member
|
||||
// certifications panel reachable by non-admin instructors.
|
||||
canGrantCerts?: boolean
|
||||
// True when the viewer holds door.manage. Adds a per-member access-cards
|
||||
// panel (card UID is a credential; managers only).
|
||||
canManageCards?: boolean
|
||||
}
|
||||
|
||||
const TIER_COLORS: Record<string, string> = {
|
||||
@@ -38,9 +42,10 @@ const TIER_COLORS: Record<string, string> = {
|
||||
|
||||
const isAdmin = (role: string) => role === 'admin' || role === 'board'
|
||||
|
||||
export function MembersClient({ members: initialMembers, currentRole, areaLeadRoles = [], inviteSlot, canGrantCerts = false }: Props) {
|
||||
export function MembersClient({ members: initialMembers, currentRole, areaLeadRoles = [], inviteSlot, canGrantCerts = false, canManageCards = false }: Props) {
|
||||
const router = useRouter()
|
||||
const [certMember, setCertMember] = useState<Member | null>(null)
|
||||
const [cardMember, setCardMember] = useState<Member | null>(null)
|
||||
const confirm = useConfirm()
|
||||
const [members, setMembers] = useState<Member[]>(initialMembers)
|
||||
|
||||
@@ -280,6 +285,9 @@ export function MembersClient({ members: initialMembers, currentRole, areaLeadRo
|
||||
{canGrantCerts && (
|
||||
<th className="px-4 py-3 text-left font-mono text-[10px] tracking-widest text-muted-foreground">CERTS</th>
|
||||
)}
|
||||
{canManageCards && (
|
||||
<th className="px-4 py-3 text-left font-mono text-[10px] tracking-widest text-muted-foreground">CARDS</th>
|
||||
)}
|
||||
{isAdmin(currentRole) && (
|
||||
<th className="px-4 py-3 text-left font-mono text-[10px] tracking-widest text-muted-foreground">ACTIONS</th>
|
||||
)}
|
||||
@@ -344,6 +352,16 @@ export function MembersClient({ members: initialMembers, currentRole, areaLeadRo
|
||||
</button>
|
||||
</td>
|
||||
)}
|
||||
{canManageCards && (
|
||||
<td className="px-4 py-3">
|
||||
<button
|
||||
onClick={() => setCardMember(m)}
|
||||
className="font-mono text-[10px] border border-border px-3 py-2 min-h-[44px] rounded hover:border-primary hover:text-primary transition"
|
||||
>
|
||||
CARDS
|
||||
</button>
|
||||
</td>
|
||||
)}
|
||||
{isAdmin(currentRole) && (
|
||||
<td className="px-4 py-3">
|
||||
<div className="flex items-center gap-2">
|
||||
@@ -389,7 +407,7 @@ export function MembersClient({ members: initialMembers, currentRole, areaLeadRo
|
||||
)
|
||||
}) : (
|
||||
<tr>
|
||||
<td colSpan={5 + (canGrantCerts ? 1 : 0) + (isAdmin(currentRole) ? 1 : 0)} className="p-0">
|
||||
<td colSpan={5 + (canGrantCerts ? 1 : 0) + (canManageCards ? 1 : 0) + (isAdmin(currentRole) ? 1 : 0)} className="p-0">
|
||||
<Empty className="border-0">
|
||||
<EmptyHeader>
|
||||
<EmptyMedia variant="icon"><Users /></EmptyMedia>
|
||||
@@ -450,6 +468,13 @@ export function MembersClient({ members: initialMembers, currentRole, areaLeadRo
|
||||
onClose={() => setCertMember(null)}
|
||||
/>
|
||||
)}
|
||||
|
||||
{canManageCards && (
|
||||
<MemberCardsDialog
|
||||
member={cardMember ? { id: cardMember.id, display_name: cardMember.display_name } : null}
|
||||
onClose={() => setCardMember(null)}
|
||||
/>
|
||||
)}
|
||||
</div>
|
||||
)
|
||||
}
|
||||
|
||||
@@ -95,12 +95,18 @@ export default async function MembersPage() {
|
||||
sid: self.space_id,
|
||||
perm: 'certifications.grant',
|
||||
})
|
||||
const { data: canManageCards } = await supabase.rpc('user_has_permission', {
|
||||
uid: user.id,
|
||||
sid: self.space_id,
|
||||
perm: 'door.manage',
|
||||
})
|
||||
|
||||
return (
|
||||
<MembersClient
|
||||
members={members ?? []}
|
||||
currentRole={self.role}
|
||||
canGrantCerts={!!canGrantCerts}
|
||||
canManageCards={!!canManageCards}
|
||||
areaLeadRoles={(areaLeadRoles ?? []) as Array<{ id: string; area_name: string; lead_id: string | null }>}
|
||||
inviteSlot={
|
||||
canInvite ? (
|
||||
|
||||
Reference in New Issue
Block a user