Spaces:
Sleeping
Sleeping
File size: 4,015 Bytes
05c5ed5 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 | // Client-side permission helpers
// These mirror the server-side permissions but work with the client session
import { admin, editor, user as userRole } from "./roles";
import type { BetterAuthRole } from "./types";
import { parseRoleString, isBetterAuthRole } from "./types";
/**
* Get the role permissions based on user's role string
* Defaults to 'user' role if undefined or null
*/
function getRolePermissions(role: string | undefined | null): BetterAuthRole {
const cleanRole = parseRoleString(role);
// Default to 'user' role if no role is provided
switch (cleanRole) {
case "admin":
return admin as BetterAuthRole;
case "editor":
return editor as BetterAuthRole;
case "user":
default:
return userRole as BetterAuthRole;
}
}
/**
* Check if role has specific permission for a resource
*/
function hasPermission(
userRoleString: string | undefined | null,
permission:
| "use"
| "create"
| "list"
| "delete"
| "update"
| "view"
| "share",
resource: "agent" | "workflow" | "mcp",
): boolean {
const roleObject = getRolePermissions(userRoleString);
// Validate role object structure
if (!isBetterAuthRole(roleObject)) {
console.error("Invalid role object structure");
return false;
}
const statements = roleObject.statements;
const resourcePermissions = statements[resource] || [];
return (
Array.isArray(resourcePermissions) &&
resourcePermissions.includes(permission)
);
}
/**
* Check if user can create agents (client-side)
*/
export function canCreateAgent(userRoleString?: string | null): boolean {
return hasPermission(userRoleString, "create", "agent");
}
/**
* Check if user can edit agents (client-side)
*/
export function canEditAgent(userRoleString?: string | null): boolean {
return hasPermission(userRoleString, "update", "agent");
}
/**
* Check if user can delete agents (client-side)
*/
export function canDeleteAgent(userRoleString?: string | null): boolean {
return hasPermission(userRoleString, "delete", "agent");
}
/**
* Check if user can create workflows (client-side)
*/
export function canCreateWorkflow(userRoleString?: string | null): boolean {
return hasPermission(userRoleString, "create", "workflow");
}
/**
* Check if user can edit workflows (client-side)
*/
export function canEditWorkflow(userRoleString?: string | null): boolean {
return hasPermission(userRoleString, "update", "workflow");
}
/**
* Check if user can delete workflows (client-side)
*/
export function canDeleteWorkflow(userRoleString?: string | null): boolean {
return hasPermission(userRoleString, "delete", "workflow");
}
/**
* Check if user can create MCP connections (client-side)
*/
export function canCreateMCP(userRoleString?: string | null): boolean {
return hasPermission(userRoleString, "create", "mcp");
}
/**
* Check if user can edit MCP connections (client-side)
*/
export function canEditMCP(userRoleString?: string | null): boolean {
return hasPermission(userRoleString, "update", "mcp");
}
/**
* Check if user can change visibility of MCP connections (client-side)
*/
export function canChangeVisibilityMCP(
userRoleString?: string | null,
): boolean {
return hasPermission(userRoleString, "share", "mcp");
}
/**
* Check if user can delete MCP connections (client-side)
*/
export function canDeleteMCP(userRoleString?: string | null): boolean {
return hasPermission(userRoleString, "delete", "mcp");
}
/**
* Check if user can use agents/workflows/MCP (client-side)
*/
export function canUseResource(
userRoleString?: string | null,
resourceType: "agent" | "workflow" | "mcp" = "agent",
): boolean {
return hasPermission(userRoleString, "use", resourceType);
}
/**
* Check if user can view resources (client-side)
*/
export function canViewResource(
userRoleString?: string | null,
resourceType: "agent" | "workflow" | "mcp" = "agent",
): boolean {
return hasPermission(userRoleString, "view", resourceType);
}
|