d3b94b1ed3
- Introduced PermissionsGuard to enforce permission checks on routes. - Added RequirePermissions decorator for specifying required permissions on handlers. - Created AUTH_ERRORS constants for consistent error messages across the auth module. - Updated CsrfService to reduce CSRF token expiry time for enhanced security. - Refactored auth cookie handling into utility functions for better maintainability. - Enhanced TokenBlacklistService to default to fail-closed in production environments. - Updated various DTOs and schemas for consistency and clarity. - Removed legacy code and types related to SIM requests. - Improved logging and error handling in GlobalAuthGuard. - Added middleware for public path checks and optimistic authentication.
83 lines
2.1 KiB
TypeScript
83 lines
2.1 KiB
TypeScript
/**
|
|
* RBAC Permissions
|
|
*
|
|
* Defines the permission constants and role-permission mappings
|
|
* for the customer portal authorization system.
|
|
*/
|
|
|
|
export const PERMISSIONS = {
|
|
// Account permissions
|
|
ACCOUNT_READ: "account:read",
|
|
ACCOUNT_UPDATE: "account:update",
|
|
|
|
// Billing permissions
|
|
BILLING_READ: "billing:read",
|
|
BILLING_PAY: "billing:pay",
|
|
|
|
// Orders permissions
|
|
ORDERS_READ: "orders:read",
|
|
ORDERS_CREATE: "orders:create",
|
|
|
|
// Services permissions
|
|
SERVICES_READ: "services:read",
|
|
SERVICES_MANAGE: "services:manage",
|
|
|
|
// Support permissions
|
|
SUPPORT_READ: "support:read",
|
|
SUPPORT_CREATE: "support:create",
|
|
|
|
// Admin permissions
|
|
ADMIN_USERS: "admin:users",
|
|
ADMIN_AUDIT: "admin:audit",
|
|
} as const;
|
|
|
|
export type Permission = (typeof PERMISSIONS)[keyof typeof PERMISSIONS];
|
|
|
|
export const ROLE_PERMISSIONS: Record<string, Permission[]> = {
|
|
USER: [
|
|
PERMISSIONS.ACCOUNT_READ,
|
|
PERMISSIONS.ACCOUNT_UPDATE,
|
|
PERMISSIONS.BILLING_READ,
|
|
PERMISSIONS.BILLING_PAY,
|
|
PERMISSIONS.ORDERS_READ,
|
|
PERMISSIONS.ORDERS_CREATE,
|
|
PERMISSIONS.SERVICES_READ,
|
|
PERMISSIONS.SERVICES_MANAGE,
|
|
PERMISSIONS.SUPPORT_READ,
|
|
PERMISSIONS.SUPPORT_CREATE,
|
|
],
|
|
ADMIN: Object.values(PERMISSIONS) as Permission[],
|
|
};
|
|
|
|
/**
|
|
* Check if a role has a specific permission
|
|
*/
|
|
export function hasPermission(role: string, permission: Permission): boolean {
|
|
const rolePermissions = ROLE_PERMISSIONS[role];
|
|
if (!rolePermissions) {
|
|
return false;
|
|
}
|
|
return rolePermissions.includes(permission);
|
|
}
|
|
|
|
/**
|
|
* Check if a role has any of the specified permissions
|
|
*/
|
|
export function hasAnyPermission(role: string, permissions: Permission[]): boolean {
|
|
return permissions.some(permission => hasPermission(role, permission));
|
|
}
|
|
|
|
/**
|
|
* Check if a role has all of the specified permissions
|
|
*/
|
|
export function hasAllPermissions(role: string, permissions: Permission[]): boolean {
|
|
return permissions.every(permission => hasPermission(role, permission));
|
|
}
|
|
|
|
/**
|
|
* Get all permissions for a role
|
|
*/
|
|
export function getPermissionsForRole(role: string): Permission[] {
|
|
return ROLE_PERMISSIONS[role] ?? [];
|
|
}
|