41 lines
1.1 KiB
TypeScript
41 lines
1.1 KiB
TypeScript
export interface AuthorizationActor {
|
|
id: number;
|
|
username: string;
|
|
rank: number;
|
|
}
|
|
export type AuthorizationDenialReason =
|
|
| "invalid_rank"
|
|
| "permission_denied"
|
|
| "no_ranks";
|
|
export type AuthorizationDecision =
|
|
| { allowed: true; superAdmin: boolean }
|
|
| { allowed: false; reason: AuthorizationDenialReason };
|
|
|
|
export function isDynamicSuperAdmin(
|
|
rank: number,
|
|
highestRank: number | null,
|
|
): boolean {
|
|
return (
|
|
Number.isInteger(rank) &&
|
|
rank > 0 &&
|
|
highestRank !== null &&
|
|
rank === highestRank
|
|
);
|
|
}
|
|
|
|
export function decideAuthorization(input: {
|
|
actor: AuthorizationActor;
|
|
highestRank: number | null;
|
|
permission?: string;
|
|
hasPermission: boolean;
|
|
}): AuthorizationDecision {
|
|
if (!Number.isInteger(input.actor.rank) || input.actor.rank <= 0)
|
|
return { allowed: false, reason: "invalid_rank" };
|
|
if (input.highestRank === null) return { allowed: false, reason: "no_ranks" };
|
|
if (isDynamicSuperAdmin(input.actor.rank, input.highestRank))
|
|
return { allowed: true, superAdmin: true };
|
|
if (!input.permission || input.hasPermission)
|
|
return { allowed: true, superAdmin: false };
|
|
return { allowed: false, reason: "permission_denied" };
|
|
}
|