Moheeb Zara
9447b5ee80
Migration 023 (folded into schema.sql section 15). ADDITIVE and backward compatible: with no permission/ACL rows the app behaves exactly as before. Schema: - space_role_permissions (space_id, subject, permission); ops_acl (space_id, entity_type secret|kb|process|area_lead, entity_id, role). Full RLS, writes admin/board. - user_effective_roles(uid,sid): built-in role + custom-role slugs + area_lead:<id> for areas the member leads. SECURITY DEFINER. - user_has_permission(uid,sid,perm): admin implicit-all else a grant via an effective role. SECURITY DEFINER. - secrets/knowledge_base SELECT rewritten as `exact existing rule OR ops_acl match` (only widens; zero change with no ACL rows). Seed + backfill default role permissions. Area-lead roles reuse the existing area_leads table rather than duplicating the concept: a row is a role, lead_id NULL = Vacant, assigning sets lead_id, the member then holds area_lead:<id>. App: - lib/permissions-catalog.ts (codes + per-role defaults + guardrails), Zod schemas, lib/actions/permissions.ts (setRolePermissions, setOpsAcl, createAreaLeadRole, assign/unassign/delete). - Customize gains Permissions (role x permission matrix, admin shown implicit-all/locked) and Area leads (create/Vacant/assign) panels, modular under customize/panels/. Reusable components/ops/ops-acl-editor.tsx wired into the Secrets list. Audit-found latent fixes: - revealSecret errors on encrypted-but-no-ciphertext corruption instead of silently returning the stale plaintext column. - upsertAreaLead rejects null/empty area_code (NULLs are distinct in unique constraints; allowed duplicate rows). types/database.ts: added the two new tables. 271/271 tests pass, build clean. KB-modal ACL wiring + members-row shortcut deferred and tracked in HANDOFF.
52 lines
2.7 KiB
TypeScript
52 lines
2.7 KiB
TypeScript
// Fixed catalog of permission codes. This is app-owned data, not a table:
|
|
// the set of capabilities is part of the product, while which roles hold
|
|
// which permissions is per-space (space_role_permissions).
|
|
//
|
|
// Important: this layer is ADDITIVE. Existing role-based RLS and server-action
|
|
// role checks stay in force. A permission grant can only widen what a role can
|
|
// do through the surfaces that consult it (the Ops ACL and the Customize
|
|
// permissions UI); it never overrides the database RLS that protects tenant
|
|
// isolation. `admin` implicitly holds every permission and can never be
|
|
// locked out.
|
|
|
|
export const PERMISSIONS = [
|
|
{ code: 'ops.kb.read', group: 'Ops', label: 'Read knowledge base' },
|
|
{ code: 'ops.kb.write', group: 'Ops', label: 'Write knowledge base' },
|
|
{ code: 'ops.process.read', group: 'Ops', label: 'Read processes' },
|
|
{ code: 'ops.process.write', group: 'Ops', label: 'Write processes' },
|
|
{ code: 'ops.secrets.read', group: 'Ops', label: 'Reveal secrets' },
|
|
{ code: 'ops.secrets.write', group: 'Ops', label: 'Manage secrets' },
|
|
{ code: 'ops.arealeads.manage', group: 'Ops', label: 'Manage area leads' },
|
|
{ code: 'members.manage', group: 'People', label: 'Manage members' },
|
|
{ code: 'payments.manage', group: 'Finance', label: 'Manage payments' },
|
|
{ code: 'governance.manage', group: 'Governance', label: 'Manage proposals, incidents, policies' },
|
|
{ code: 'forum.moderate', group: 'Community', label: 'Moderate forum and comments' },
|
|
{ code: 'customize.manage', group: 'Admin', label: 'Customize roles, tiers, areas, invites, onboarding' },
|
|
{ code: 'settings.manage', group: 'Admin', label: 'Space settings, integrations, webhooks' },
|
|
] as const
|
|
|
|
export type PermissionCode = (typeof PERMISSIONS)[number]['code']
|
|
|
|
export const PERMISSION_CODES: readonly string[] = PERMISSIONS.map(p => p.code)
|
|
|
|
export const PERMISSION_GROUPS: string[] = Array.from(new Set(PERMISSIONS.map(p => p.group)))
|
|
|
|
// Built-in role defaults seeded per space. `admin` is intentionally absent:
|
|
// it holds everything implicitly and is never stored, so it cannot be
|
|
// accidentally revoked.
|
|
export const DEFAULT_ROLE_PERMISSIONS: Record<string, PermissionCode[]> = {
|
|
board: [
|
|
'ops.kb.read', 'ops.kb.write', 'ops.process.read', 'ops.process.write',
|
|
'ops.secrets.read', 'ops.secrets.write', 'ops.arealeads.manage',
|
|
'members.manage', 'payments.manage', 'governance.manage',
|
|
'forum.moderate', 'customize.manage', 'settings.manage',
|
|
],
|
|
treasurer: ['payments.manage', 'ops.kb.read', 'ops.process.read'],
|
|
member: ['ops.kb.read', 'ops.process.read'],
|
|
associate: ['ops.kb.read'],
|
|
}
|
|
|
|
export function isValidPermission(code: string): code is PermissionCode {
|
|
return PERMISSION_CODES.includes(code)
|
|
}
|