-
Notifications
You must be signed in to change notification settings - Fork 19
/
authorisation.ts
134 lines (107 loc) · 3.51 KB
/
authorisation.ts
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
import { AbilityBuilder, CreateAbility, MongoAbility, createMongoAbility } from "@casl/ability";
import { Team as DbTeam, User as DbUser, db, teamMembers, Invitation as DbInvitation } from "@template/db";
import { and, eq } from "drizzle-orm";
type User = {
kind: "User";
} & Partial<DbUser>;
type Team = {
kind: "Team";
} & Partial<DbTeam>;
type Invitation = {
kind: "Invitation";
} & Partial<DbInvitation>;
type GetUserParams = { teamId: number; userId: string };
async function getUser({ teamId, userId }: GetUserParams) {
const member = await db.query.teamMembers.findFirst({
where: and(eq(teamMembers.userId, userId), eq(teamMembers.teamId, teamId)),
with: {
user: true,
},
});
if (!member) {
return undefined;
}
return {
role: member.role,
...member.user,
};
}
type Member = { kind: "Member" } & Partial<Awaited<ReturnType<typeof getUser>>>;
type CRUD = "create" | "read" | "update" | "delete";
type AppAbilities =
| ["update", User | "User"]
| [CRUD, Team | "Team"]
| ["update" | "invite" | "remove", Member | "Member"]
| ["revoke", Invitation | "Invitation"]
| ["create" | "update", "Subscription"];
export type AppAbility = MongoAbility<AppAbilities>;
export const createAppAbility = createMongoAbility as CreateAbility<AppAbility>;
let ANONYMOUS_ABILITY: AppAbility;
export async function defineAbilityFor(params?: GetUserParams) {
if (!params || (params && !params.userId)) {
ANONYMOUS_ABILITY = ANONYMOUS_ABILITY || createAppAbility(defineRulesFor());
return ANONYMOUS_ABILITY;
}
const user = await getUser(params);
if (!user) {
ANONYMOUS_ABILITY = ANONYMOUS_ABILITY || createAppAbility(defineRulesFor());
return ANONYMOUS_ABILITY;
}
return createAppAbility(defineRulesFor({ kind: "Member", ...user }), {
detectSubjectType: (object) => object.kind,
});
}
export function defineRulesFor(user?: Member) {
const builder = new AbilityBuilder<AppAbility>(createAppAbility);
switch (user?.role) {
case "admin":
defineAdminRules(builder, user);
break;
case "member":
defineMemberRules(builder, user);
break;
case "owner":
defineOwnerRules(builder, user);
break;
default:
break;
}
return builder.rules;
}
function defineOwnerRules({ can }: AbilityBuilder<AppAbility>, user: NonNullable<Member>) {
// Team
can(["create"], "Team");
can(["read", "update", "delete"], "Team", { id: user.activeTeamId });
// User
can("update", "User", { id: { $eq: user.id } });
// Member
can("update", "Member", { role: { $eq: "owner" } });
can("update", "Member", { role: { $eq: "admin" } });
can("update", "Member", { role: { $eq: "member" } });
can("invite", "Member");
can("remove", "Member", { role: { $in: ["admin", "member"] } });
// Invitation
can("revoke", "Invitation");
// Billing
can("create", "Subscription");
can("update", "Subscription");
}
function defineAdminRules({ can }: AbilityBuilder<AppAbility>, user: NonNullable<Member>) {
// Team
can(["create"], "Team");
can(["read", "update"], "Team", { id: user.activeTeamId });
// User
can("update", "User", { id: { $eq: user.id } });
// Member
can("update", "Member", { role: { $eq: "member" } });
can("invite", "Member");
can("remove", "Member", { role: "member" });
// Invitation
can("revoke", "Invitation");
}
function defineMemberRules({ can }: AbilityBuilder<AppAbility>, user: NonNullable<Member>) {
// Team
can(["create"], "Team");
// User
can("update", "User", { id: { $eq: user.id } });
}