Gergő Jedlicska
7c16abc8eb
* feat(workspaces): add workspaces module with roles and scopes * feat(workspaces): add domain, graphql and persistent storage dataschema * fix(workspaces): correct db injections * chore(workspaces): add EE license * chore(license): mentions workspaces separately in license file * fix(core): roles import in migration * fix(workspaces): drop workspace_acl on down migration * fix(workspaces): roles constants * fix(workspaces): coding standards --------- Co-authored-by: Dimitrie Stefanescu <didimitrie@gmail.com>
84 lines
2.2 KiB
TypeScript
84 lines
2.2 KiB
TypeScript
import {
|
|
UserServerRole,
|
|
UserStreamRole
|
|
} from '@/modules/shared/domain/rolesAndScopes/types'
|
|
import { Roles } from '@/modules/core/helpers/mainConstants'
|
|
|
|
// Conventions:
|
|
// "weight: 1000" => resource owner
|
|
// "weight: 100" => resource viewer / basic user
|
|
// Anything in between 100 and 1000 can be used for escalating privileges.
|
|
|
|
const coreUserRoles: Array<UserServerRole | UserStreamRole> = [
|
|
/**
|
|
* Roles for "this" server.
|
|
*/
|
|
{
|
|
name: Roles.Server.Admin,
|
|
description:
|
|
'Holds supreme autocratic authority, not restricted by written laws, legislature, or customs.',
|
|
resourceTarget: 'server',
|
|
aclTableName: 'server_acl',
|
|
weight: 1000,
|
|
public: false
|
|
},
|
|
{
|
|
name: Roles.Server.User,
|
|
description: 'Has normal access to the server.',
|
|
resourceTarget: 'server',
|
|
aclTableName: 'server_acl',
|
|
weight: 100,
|
|
public: false
|
|
},
|
|
// TODO: should this be dynamically pushed if guest role is enabled?
|
|
// feels risky, since feature can be toggled on and off,
|
|
// but user roles are not updated
|
|
// can leave the guest users in a broken state
|
|
{
|
|
name: Roles.Server.Guest,
|
|
description: 'Has limited access to the server.',
|
|
resourceTarget: 'server',
|
|
aclTableName: 'server_acl',
|
|
weight: 50,
|
|
public: false
|
|
},
|
|
{
|
|
name: Roles.Server.ArchivedUser,
|
|
description: 'No longer has access to the server.',
|
|
resourceTarget: 'server',
|
|
aclTableName: 'server_acl',
|
|
weight: 10,
|
|
public: false
|
|
},
|
|
/**
|
|
* Roles for streams.
|
|
*/
|
|
{
|
|
name: Roles.Stream.Owner,
|
|
description: 'Owners have full access, including deletion rights & access control.',
|
|
resourceTarget: 'streams',
|
|
aclTableName: 'stream_acl',
|
|
weight: 1000,
|
|
public: true
|
|
},
|
|
{
|
|
name: Roles.Stream.Contributor,
|
|
description:
|
|
'Contributors can create new branches and commits, but they cannot edit stream details or manage collaborators.',
|
|
resourceTarget: 'streams',
|
|
aclTableName: 'stream_acl',
|
|
weight: 500,
|
|
public: true
|
|
},
|
|
{
|
|
name: Roles.Stream.Reviewer,
|
|
description: 'Reviewers can only view (read) the data from this stream.',
|
|
resourceTarget: 'streams',
|
|
aclTableName: 'stream_acl',
|
|
weight: 100,
|
|
public: true
|
|
}
|
|
]
|
|
|
|
export default coreUserRoles
|