47 lines
1.9 KiB
TypeScript
47 lines
1.9 KiB
TypeScript
import { getDatabase } from '$lib/server/database';
|
|
import type { AuthUser } from './session';
|
|
import { error } from '@sveltejs/kit';
|
|
|
|
export async function getPermissions(user: AuthUser | null): Promise<string[]> {
|
|
if (!user) return [];
|
|
if (user.role === 'admin') return ['*'];
|
|
const database = await getDatabase();
|
|
const rows = await (await database.prepare(`
|
|
SELECT permissions.name FROM permissions
|
|
JOIN role_permissions ON role_permissions.permission_id=permissions.id
|
|
JOIN user_roles ON user_roles.role_id=role_permissions.role_id
|
|
WHERE user_roles.user_id=?
|
|
UNION
|
|
SELECT permissions.name FROM permissions
|
|
JOIN user_permissions ON user_permissions.permission_id=permissions.id
|
|
WHERE user_permissions.user_id=?
|
|
`)).all(user.id, user.id);
|
|
const permissions = rows.map((row) => String(row.name));
|
|
return permissions.includes('system.admin') ? ['*'] : permissions;
|
|
}
|
|
|
|
export async function hasPermission(user: AuthUser | null, permission: string): Promise<boolean> {
|
|
const permissions = await getPermissions(user);
|
|
return permissions.includes('*') || permissions.includes(permission);
|
|
}
|
|
|
|
export async function requirePermission(user: AuthUser | null, permission: string): Promise<AuthUser> {
|
|
if (!user) error(401, 'Sign in required');
|
|
if (!(await hasPermission(user, permission))) error(403, 'ISAC permission required');
|
|
return user;
|
|
}
|
|
|
|
export async function requireDataView(user: AuthUser | null): Promise<AuthUser> {
|
|
if (!user) error(401, 'Sign in required');
|
|
const permissions = await getPermissions(user);
|
|
if (!permissions.includes('*') && !['data.view', 'data.manage', 'data.propose', 'data.approve'].some((permission) => permissions.includes(permission))) {
|
|
error(403, 'ISAC data access required');
|
|
}
|
|
return user;
|
|
}
|
|
|
|
export function requireAdmin(user: AuthUser | null): asserts user is AuthUser {
|
|
if (!user) error(401, 'Sign in required');
|
|
if (user.role !== 'admin') error(403, 'Administrator permission required');
|
|
}
|