Repository navigation
Expand file tree
/
Copy pathauth.ts
More file actions
101 lines (90 loc) · 2.49 KB
/
Copy pathauth.ts
File metadata and controls
101 lines (90 loc) · 2.49 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
/**
* Roles, permissions and route helpers.
*
* This module is imported by client components (navigation) as well as server
* code, so it must stay free of server-only imports.
*/
export type UserRole = "admin" | "staff" | "trainer" | "member"
export type AuthPortal = "staff" | "member"
export type AuthUser = {
id: string
name: string
email: string
role: UserRole
memberId: string | null
trainerId: string | null
}
export const ROLE_LABELS: Record<UserRole, string> = {
admin: "Owner / Admin",
staff: "Front Desk Staff",
trainer: "Trainer",
member: "Member",
}
/**
* Every guarded capability in the product. Keeping the list explicit means a
* new screen cannot silently become world-readable.
*/
export type Permission =
| "members:read"
| "members:write"
| "trainers:read"
| "trainers:write"
| "schedule:read"
| "schedule:write"
| "payments:read"
| "payments:write"
| "inventory:read"
| "inventory:write"
| "analytics:read"
| "settings:read"
| "settings:write"
| "team:manage"
| "checkin:write"
const ROLE_PERMISSIONS: Record<UserRole, Permission[]> = {
admin: [
"members:read",
"members:write",
"trainers:read",
"trainers:write",
"schedule:read",
"schedule:write",
"payments:read",
"payments:write",
"inventory:read",
"inventory:write",
"analytics:read",
"settings:read",
"settings:write",
"team:manage",
"checkin:write",
],
staff: [
"members:read",
"members:write",
"trainers:read",
"schedule:read",
"schedule:write",
"payments:read",
"payments:write",
"inventory:read",
"inventory:write",
"analytics:read",
"settings:read",
"checkin:write",
],
trainer: ["members:read", "trainers:read", "schedule:read", "schedule:write", "checkin:write", "settings:read"],
member: [],
}
export function can(role: UserRole, permission: Permission) {
return ROLE_PERMISSIONS[role].includes(permission)
}
export const isStaffRole = (role: UserRole) => role !== "member"
export const getHomeRouteForRole = (role: UserRole) => (role === "member" ? "/member" : "/dashboard")
export const getLoginRouteForRole = (role: UserRole) => (role === "member" ? "/member/login" : "/login")
export const getPortalForRole = (role: UserRole): AuthPortal => (role === "member" ? "member" : "staff")
export class AuthorizationError extends Error {
constructor(message = "You do not have permission to perform this action.") {
super(message)
this.name = "AuthorizationError"
}
}