Add ISAC user operations and access roles

src/lib/server/auth/authorization.ts

@@ -1,11 +1,36 @@
+import { getDatabase } from '$lib/server/database';
 import type { AuthUser } from './session';
 import { error } from '@sveltejs/kit';
 
-/**
- * Every admin page, action, and endpoint must call this server-side.
- * The capability-based permission checks will replace the broad admin role
- * as the permission editor is introduced.
- */
+export async function getPermissions(user: AuthUser | null): Promise<string[]> {
+	if (!user) return [];
+	if (user.role === 'admin') return ['*'];
+	const database = await getDatabase();
+	const rows = await (await database.prepare(`
+		SELECT permissions.name FROM permissions
+		JOIN role_permissions ON role_permissions.permission_id=permissions.id
+		JOIN user_roles ON user_roles.role_id=role_permissions.role_id
+		WHERE user_roles.user_id=?
+		UNION
+		SELECT permissions.name FROM permissions
+		JOIN user_permissions ON user_permissions.permission_id=permissions.id
+		WHERE user_permissions.user_id=?
+	`)).all(user.id, user.id);
+	const permissions = rows.map((row) => String(row.name));
+	return permissions.includes('system.admin') ? ['*'] : permissions;
+}
+
+export async function hasPermission(user: AuthUser | null, permission: string): Promise<boolean> {
+	const permissions = await getPermissions(user);
+	return permissions.includes('*') || permissions.includes(permission);
+}
+
+export async function requirePermission(user: AuthUser | null, permission: string): Promise<AuthUser> {
+	if (!user) error(401, 'Sign in required');
+	if (!(await hasPermission(user, permission))) error(403, 'ISAC permission required');
+	return user;
+}
+
 export function requireAdmin(user: AuthUser | null): asserts user is AuthUser {
 	if (!user) error(401, 'Sign in required');
 	if (user.role !== 'admin') error(403, 'Administrator permission required');