52 lines
1.3 KiB
TypeScript
52 lines
1.3 KiB
TypeScript
/**
|
|
* The role permissions, one table for the server that enforces them and the
|
|
* client that hides what a role can't do.
|
|
*
|
|
* @module
|
|
*/
|
|
|
|
import type { Role } from "./user.ts";
|
|
|
|
/**
|
|
* Named capabilities checked at enforcement points. Extend this union as new
|
|
* gated capabilities are added (e.g. "invite:manage").
|
|
*/
|
|
export type Permission =
|
|
| "dump:moderate"
|
|
| "comment:moderate"
|
|
| "playlist:moderate"
|
|
| "chat:moderate"
|
|
| "user:manage"
|
|
| "category:manage";
|
|
|
|
/** Every {@link Permission}. */
|
|
const ALL_PERMISSIONS: readonly Permission[] = [
|
|
"dump:moderate",
|
|
"comment:moderate",
|
|
"playlist:moderate",
|
|
"chat:moderate",
|
|
"user:manage",
|
|
"category:manage",
|
|
];
|
|
|
|
/**
|
|
* What each role may do. Roles are fixed in code. `admin` is a superset of
|
|
* every permission (current and future); `moderator` gets the
|
|
* content-moderation permissions only.
|
|
*/
|
|
export const ROLE_PERMISSIONS: Record<Role, readonly Permission[]> = {
|
|
admin: ALL_PERMISSIONS,
|
|
moderator: [
|
|
"dump:moderate",
|
|
"comment:moderate",
|
|
"playlist:moderate",
|
|
"chat:moderate",
|
|
],
|
|
user: [],
|
|
};
|
|
|
|
/** Checks whether `role` grants `permission`. */
|
|
export function hasPermission(role: Role, permission: Permission): boolean {
|
|
return ROLE_PERMISSIONS[role].includes(permission);
|
|
}
|