inital commit

Overlord-Server/src/rbac.ts

@@ -0,0 +1,105 @@
+import { type AuthenticatedUser } from "./auth";
+import { hasPermission, type UserRole } from "./users";
+
+export type Permission =
+  | "users:manage"
+  | "clients:control"
+  | "clients:view"
+  | "audit:view";
+
+export function checkPermission(
+  user: AuthenticatedUser | null,
+  permission: Permission,
+): boolean {
+  if (!user) return false;
+  return hasPermission(user.role, permission);
+}
+
+export function checkAnyPermission(
+  user: AuthenticatedUser | null,
+  permissions: Permission[],
+): boolean {
+  if (!user) return false;
+  return permissions.some((p) => hasPermission(user.role, p));
+}
+
+export function checkAllPermissions(
+  user: AuthenticatedUser | null,
+  permissions: Permission[],
+): boolean {
+  if (!user) return false;
+  return permissions.every((p) => hasPermission(user.role, p));
+}
+
+export function requireAuth(user: AuthenticatedUser | null): AuthenticatedUser {
+  if (!user) {
+    throw new Response("Unauthorized", { status: 401 });
+  }
+  return user;
+}
+
+export function requirePermission(
+  user: AuthenticatedUser | null,
+  permission: Permission,
+): AuthenticatedUser {
+  const authedUser = requireAuth(user);
+
+  if (!checkPermission(authedUser, permission)) {
+    throw new Response("Forbidden: Insufficient permissions", { status: 403 });
+  }
+
+  return authedUser;
+}
+
+export function requireAnyPermission(
+  user: AuthenticatedUser | null,
+  permissions: Permission[],
+): AuthenticatedUser {
+  const authedUser = requireAuth(user);
+
+  if (!checkAnyPermission(authedUser, permissions)) {
+    throw new Response("Forbidden: Insufficient permissions", { status: 403 });
+  }
+
+  return authedUser;
+}
+
+export function getPermissionDescription(permission: Permission): string {
+  switch (permission) {
+    case "users:manage":
+      return "Manage users and roles";
+    case "clients:control":
+      return "Control clients (execute commands, desktop, console, files)";
+    case "clients:view":
+      return "View connected clients";
+    case "audit:view":
+      return "View audit logs";
+    default:
+      return "Unknown permission";
+  }
+}
+
+export function getRoleDescription(role: UserRole): string {
+  switch (role) {
+    case "admin":
+      return "Full access - can manage users and control all clients";
+    case "operator":
+      return "Can control clients but cannot manage users";
+    case "viewer":
+      return "Read-only access to view clients";
+    default:
+      return "Unknown role";
+  }
+}
+
+export function getRolePermissions(role: UserRole): Permission[] {
+  const permissions: Permission[] = [];
+
+  if (hasPermission(role, "users:manage")) permissions.push("users:manage");
+  if (hasPermission(role, "clients:control"))
+    permissions.push("clients:control");
+  if (hasPermission(role, "clients:view")) permissions.push("clients:view");
+  if (hasPermission(role, "audit:view")) permissions.push("audit:view");
+
+  return permissions;
+}