♻️ Use new authorization can in group, auth

src/_staart/helpers/authorization.ts

@@ -27,6 +27,7 @@ export const BaseScopesUser = {
 export const BaseScopesGroup = {
   INFO: "groups/info",
   API_KEYS: "groups/api-keys",
+  API_KEY_LOGS: "groups/api-key-logs",
   BILLING: "groups/billing",
   DOMAINS: "groups/domains",
   INVOICES: "groups/invoices",
@@ -35,6 +36,7 @@ export const BaseScopesGroup = {
   SUBSCRIPTIONS: "groups/subscriptions",
   TRANSACTIONS: "groups/transactions",
   WEBHOOKS: "groups/webhooks",
+  SECURITY: "groups/security",
 };
 export const BaseScopesAdmin = {
   GROUPS: "admin/groups",
@@ -62,9 +64,13 @@ const getPolicyForUser = async (userId: number) => {
       const groupMemberships = await prisma.memberships.findMany({
         where: { groupId: membership.groupId },
       });
+      policy += `p, user-${userId}, group-${membership.groupId}, ${Acts.DELETE}\n`;
       groupMemberships.forEach((groupMembership) => {
-        if (groupMembership.role !== "OWNER")
+        policy += `p, user-${userId}, membership-${groupMembership.id}, ${Acts.READ}\n`;
+        if (groupMembership.role !== "OWNER") {
+          policy += `p, user-${userId}, membership-${groupMembership.id}, ${Acts.WRITE}\n`;
           policy += `p, user-${userId}, membership-${groupMembership.id}, ${Acts.DELETE}\n`;
+        }
       });
     }
     Object.values(ScopesGroup).forEach((scope) => {

src/_staart/rest/auth.ts

@@ -16,8 +16,8 @@ import {
 } from "@staart/errors";
 import { compare, hash } from "@staart/text";
 import { authenticator } from "otplib";
-import { ALLOW_DISPOSABLE_EMAILS } from "../../config";
-import { can } from "../helpers/authorization";
+import { ALLOW_DISPOSABLE_EMAILS, ScopesAdmin } from "../../config";
+import { can, Acts } from "../helpers/authorization";
 import { deleteItemFromCache } from "../helpers/cache";
 import {
   checkInvalidatedToken,
@@ -296,9 +296,7 @@ export const impersonate = async (
   impersonateUserId: number,
   locals: Locals | any
 ) => {
-  if (
-    !(await can(tokenUserId, UserScopes.IMPERSONATE, "user", impersonateUserId))
-  )
+  if (!(await can(tokenUserId, Acts.WRITE, ScopesAdmin.USERS)))
     throw new Error(INSUFFICIENT_PERMISSION);
 
   const user = await getUserById(impersonateUserId);