نسخهٔ وب مستقل — پلتفرم نیروی کار هوش مصنوعی

مخزن اختصاصی برنامهٔ وب؛ محتوای پوشهٔ web در ریشهٔ مخزن قرار گرفت. تاریخچهٔ پروژهٔ ربات (agy-bot) در این مخزن وجود ندارد و هیچ وابستگی runtime به آن نیست.
2026-10-13 00:39:28 +03:30
commit 717e53a7ce
185 changed files with 39910 additions and 0 deletions
@@ -0,0 +1,57 @@
+/**
+ * Client-side capability mirror.
+ *
+ * This mirrors ``app/domain/identity/models.py`` so the UI can hide actions a
+ * role cannot perform. It is **only** a UX affordance: the API re-checks every
+ * capability server-side, and nothing here is a security boundary.
+ */
+
+import type { Role } from "@agy/contracts";
+
+export const CAN_MANAGE_ORG = "org.manage";
+export const CAN_MANAGE_MEMBERS = "org.members";
+export const CAN_MANAGE_PROJECTS = "projects.manage";
+export const CAN_MANAGE_EMPLOYEES = "employees.manage";
+export const CAN_RUN_TASKS = "tasks.run";
+export const CAN_VIEW_BILLING = "billing.view";
+export const CAN_MANAGE_BILLING = "billing.manage";
+export const CAN_VIEW_AUDIT = "audit.view";
+export const CAN_USE_SANDBOX = "sandbox.use";
+
+const ROLE_CAPABILITIES: Record<Role, ReadonlySet<string>> = {
+  viewer: new Set(),
+  member: new Set([CAN_RUN_TASKS, CAN_VIEW_BILLING]),
+  manager: new Set([
+    CAN_RUN_TASKS,
+    CAN_VIEW_BILLING,
+    CAN_MANAGE_PROJECTS,
+    CAN_MANAGE_EMPLOYEES,
+    CAN_USE_SANDBOX,
+  ]),
+  admin: new Set([
+    CAN_RUN_TASKS,
+    CAN_VIEW_BILLING,
+    CAN_MANAGE_BILLING,
+    CAN_MANAGE_PROJECTS,
+    CAN_MANAGE_EMPLOYEES,
+    CAN_USE_SANDBOX,
+    CAN_MANAGE_MEMBERS,
+    CAN_VIEW_AUDIT,
+  ]),
+  owner: new Set([
+    CAN_RUN_TASKS,
+    CAN_VIEW_BILLING,
+    CAN_MANAGE_BILLING,
+    CAN_MANAGE_PROJECTS,
+    CAN_MANAGE_EMPLOYEES,
+    CAN_USE_SANDBOX,
+    CAN_MANAGE_MEMBERS,
+    CAN_VIEW_AUDIT,
+    CAN_MANAGE_ORG,
+  ]),
+};
+
+export function roleHasCapability(role: Role | undefined | null, capability: string): boolean {
+  if (!role) return false;
+  return ROLE_CAPABILITIES[role]?.has(capability) ?? false;
+}