92 lines
2.5 KiB
TypeScript
92 lines
2.5 KiB
TypeScript
import type { AdminPermissionName } from "@hivegrid/db/admin-permissions";
|
|
|
|
/**
|
|
* One permission vocabulary for admin navigation, command search, breadcrumbs
|
|
* and direct route guards. A route must not invent a second, weaker gate.
|
|
*/
|
|
export const ADMIN_AREA_ACCESS = {
|
|
dashboard: "admin.dashboard.view",
|
|
employees: "admin_identity.users.read",
|
|
roles: "admin_identity.roles.read",
|
|
security: "admin_identity.sessions.read",
|
|
support: "admin_identity.impersonation.start",
|
|
health: "admin.metrics.view",
|
|
jobs: "admin.metrics.view",
|
|
system: "admin.metrics.view",
|
|
deploys: "admin.metrics.view",
|
|
featureFlags: "admin.featureFlags.view",
|
|
sales: "admin_sales.crm.read",
|
|
salesCommunication: [
|
|
"admin_sales.email.send",
|
|
"admin_sales.phone.call",
|
|
"admin_sales.booking.manage",
|
|
],
|
|
salesReporting: "admin_sales.reporting.read",
|
|
} as const satisfies Record<
|
|
string,
|
|
AdminPermissionName | readonly AdminPermissionName[]
|
|
>;
|
|
|
|
export type AdminAreaKey = keyof typeof ADMIN_AREA_ACCESS;
|
|
|
|
export const ADMIN_ROUTE_ACCESS = [
|
|
{
|
|
area: "dashboard",
|
|
path: "/dashboard",
|
|
breadcrumbKey: "app.sidebar.dashboard",
|
|
permission: ADMIN_AREA_ACCESS.dashboard,
|
|
},
|
|
{
|
|
area: "employees",
|
|
path: "/settings/admin-users",
|
|
breadcrumbKey: "admin.sales.adminUsers.title",
|
|
permission: ADMIN_AREA_ACCESS.employees,
|
|
},
|
|
{
|
|
area: "roles",
|
|
path: "/settings/admin-roles",
|
|
breadcrumbKey: "admin.sales.adminRoles.title",
|
|
permission: ADMIN_AREA_ACCESS.roles,
|
|
},
|
|
{
|
|
area: "support",
|
|
path: "/support",
|
|
breadcrumbKey: "admin.supportInbox.title",
|
|
permission: ADMIN_AREA_ACCESS.support,
|
|
},
|
|
{
|
|
area: "health",
|
|
path: "/system",
|
|
breadcrumbKey: "admin.health.title",
|
|
permission: ADMIN_AREA_ACCESS.health,
|
|
},
|
|
{
|
|
area: "jobs",
|
|
path: "/system/jobs",
|
|
breadcrumbKey: "admin.jobs.title",
|
|
permission: ADMIN_AREA_ACCESS.jobs,
|
|
},
|
|
{
|
|
area: "system",
|
|
path: "/system/health",
|
|
breadcrumbKey: "admin.system.title",
|
|
permission: ADMIN_AREA_ACCESS.system,
|
|
},
|
|
{
|
|
area: "deploys",
|
|
path: "/system/deploys",
|
|
breadcrumbKey: "admin.deploys.title",
|
|
permission: ADMIN_AREA_ACCESS.deploys,
|
|
},
|
|
] as const;
|
|
|
|
export function adminAreaAllows(
|
|
permissions: readonly string[],
|
|
area: AdminAreaKey
|
|
): boolean {
|
|
const requirement = ADMIN_AREA_ACCESS[area];
|
|
return typeof requirement === "string"
|
|
? permissions.includes(requirement)
|
|
: requirement.some((permission) => permissions.includes(permission));
|
|
}
|