mjalmoudy94
717e53a7ce
مخزن اختصاصی برنامهٔ وب؛ محتوای پوشهٔ web در ریشهٔ مخزن قرار گرفت. تاریخچهٔ پروژهٔ ربات (agy-bot) در این مخزن وجود ندارد و هیچ وابستگی runtime به آن نیست.
58 lines
1.6 KiB
TypeScript
58 lines
1.6 KiB
TypeScript
/**
|
|
* Client-side capability mirror.
|
|
*
|
|
* This mirrors ``app/domain/identity/models.py`` so the UI can hide actions a
|
|
* role cannot perform. It is **only** a UX affordance: the API re-checks every
|
|
* capability server-side, and nothing here is a security boundary.
|
|
*/
|
|
|
|
import type { Role } from "@agy/contracts";
|
|
|
|
export const CAN_MANAGE_ORG = "org.manage";
|
|
export const CAN_MANAGE_MEMBERS = "org.members";
|
|
export const CAN_MANAGE_PROJECTS = "projects.manage";
|
|
export const CAN_MANAGE_EMPLOYEES = "employees.manage";
|
|
export const CAN_RUN_TASKS = "tasks.run";
|
|
export const CAN_VIEW_BILLING = "billing.view";
|
|
export const CAN_MANAGE_BILLING = "billing.manage";
|
|
export const CAN_VIEW_AUDIT = "audit.view";
|
|
export const CAN_USE_SANDBOX = "sandbox.use";
|
|
|
|
const ROLE_CAPABILITIES: Record<Role, ReadonlySet<string>> = {
|
|
viewer: new Set(),
|
|
member: new Set([CAN_RUN_TASKS, CAN_VIEW_BILLING]),
|
|
manager: new Set([
|
|
CAN_RUN_TASKS,
|
|
CAN_VIEW_BILLING,
|
|
CAN_MANAGE_PROJECTS,
|
|
CAN_MANAGE_EMPLOYEES,
|
|
CAN_USE_SANDBOX,
|
|
]),
|
|
admin: new Set([
|
|
CAN_RUN_TASKS,
|
|
CAN_VIEW_BILLING,
|
|
CAN_MANAGE_BILLING,
|
|
CAN_MANAGE_PROJECTS,
|
|
CAN_MANAGE_EMPLOYEES,
|
|
CAN_USE_SANDBOX,
|
|
CAN_MANAGE_MEMBERS,
|
|
CAN_VIEW_AUDIT,
|
|
]),
|
|
owner: new Set([
|
|
CAN_RUN_TASKS,
|
|
CAN_VIEW_BILLING,
|
|
CAN_MANAGE_BILLING,
|
|
CAN_MANAGE_PROJECTS,
|
|
CAN_MANAGE_EMPLOYEES,
|
|
CAN_USE_SANDBOX,
|
|
CAN_MANAGE_MEMBERS,
|
|
CAN_VIEW_AUDIT,
|
|
CAN_MANAGE_ORG,
|
|
]),
|
|
};
|
|
|
|
export function roleHasCapability(role: Role | undefined | null, capability: string): boolean {
|
|
if (!role) return false;
|
|
return ROLE_CAPABILITIES[role]?.has(capability) ?? false;
|
|
}
|