19 lines
639 B
TypeScript
19 lines
639 B
TypeScript
/**
|
|
* Checks an authenticated caller's permissions. Routes call it where the
|
|
* answer depends on more than the permission, such as "the owner, or a
|
|
* moderator"; `requirePermission` gates a whole route instead.
|
|
*
|
|
* @module
|
|
*/
|
|
|
|
import { hasPermission, type Permission } from "../../shared/permissions.ts";
|
|
import type { AuthPayload } from "../model/auth.ts";
|
|
|
|
/**
|
|
* Checks whether the caller's role grants `permission`. The role is the live
|
|
* one `authenticate` put in the payload, not the token's.
|
|
*/
|
|
export function can(payload: AuthPayload, permission: Permission): boolean {
|
|
return hasPermission(payload.role, permission);
|
|
}
|