/home/techb158/cosmic-risk.abdallabala.com/src/domain
Edit: /home/techb158/cosmic-risk.abdallabala.com/src/domain/permissions.js (3730B)
const PERMISSIONS = [
"organization:view",
"organization:manage",
"workspace:manage",
"project:read",
"project:write",
"risk:read",
"risk:write",
"risk:delete",
"mitigation:write",
"gate:read",
"gate:evaluate",
"gate:review",
"report:export",
"integration:read",
"integration:manage",
"integration:sync",
"oauth:manage",
"billing:manage",
"audit:read"
];
const ROLE_PERMISSIONS = {
owner: ["*"],
admin: ["organization:view", "organization:manage", "workspace:manage", "project:read", "project:write", "risk:read", "risk:write", "risk:delete", "mitigation:write", "gate:evaluate", "gate:review", "report:export", "integration:manage", "billing:manage", "audit:read"],
project_manager: ["organization:view", "project:read", "project:write", "risk:read", "risk:write", "mitigation:write", "gate:evaluate", "report:export", "integration:read", "audit:read"],
risk_owner: ["project:read", "risk:read", "risk:write", "mitigation:write", "gate:read"],
governance_reviewer: ["project:read", "risk:read", "gate:evaluate", "gate:review", "report:export", "audit:read"],
legal_ethics_reviewer: ["project:read", "risk:read", "mitigation:write", "gate:review", "report:export", "audit:read"],
integration_admin: ["project:read", "integration:read", "integration:manage", "integration:sync", "oauth:manage", "audit:read"],
viewer: ["organization:view", "project:read", "risk:read", "gate:read", "integration:read", "report:export"],
consultant: ["workspace:manage", "project:read", "project:write", "risk:read", "risk:write", "mitigation:write", "gate:evaluate", "gate:review", "report:export", "audit:read"]
};
function unique(values) {
return Array.from(new Set(values.filter(Boolean)));
}
function resolvePermissions(roleCodeOrPermissions) {
if (Array.isArray(roleCodeOrPermissions)) return unique(roleCodeOrPermissions);
return ROLE_PERMISSIONS[roleCodeOrPermissions] ? ROLE_PERMISSIONS[roleCodeOrPermissions].slice() : [];
}
function hasPermission(roleCodeOrPermissions, permission) {
const permissions = resolvePermissions(roleCodeOrPermissions);
return permissions.includes("*") || permissions.includes(permission);
}
function assertPermission(roleCodeOrPermissions, permission) {
if (!hasPermission(roleCodeOrPermissions, permission)) {
const error = new Error(`Permission denied: ${permission}`);
error.status = 403;
throw error;
}
}
function canAccessWorkspace(membership, workspaceId) {
if (!membership || membership.status !== "ACTIVE") return false;
if (!membership.workspaceScope || membership.workspaceScope.length === 0) return true;
return membership.workspaceScope.includes(workspaceId);
}
function canMutateRisk(membership) {
return canAccessWorkspace(membership, "workspace-a") && hasPermission(membership.permissions || membership.role?.permissions, "risk:write");
}
const PLATFORM_ROLE_HIERARCHY = {
NONE: 0,
SUPER_ADMIN: 1,
SUPER_OWNER: 2
};
function requirePlatformRole(actor, minRole = "SUPER_ADMIN") {
const userRole = actor.platformRole || "NONE";
const userLevel = PLATFORM_ROLE_HIERARCHY[userRole] || 0;
const requiredLevel = PLATFORM_ROLE_HIERARCHY[minRole] || 0;
if (userLevel < requiredLevel) {
const error = new Error(`Platform role "${minRole}" or higher required. Current: ${userRole}`);
error.status = 403;
throw error;
}
}
function isSuperUser(actor) {
const role = actor.platformRole || "NONE";
return role === "SUPER_ADMIN" || role === "SUPER_OWNER";
}
module.exports = {
PERMISSIONS,
ROLE_PERMISSIONS,
resolvePermissions,
hasPermission,
assertPermission,
canAccessWorkspace,
canMutateRisk,
PLATFORM_ROLE_HIERARCHY,
requirePlatformRole,
isSuperUser
};