julian
d0841c8601
Replace the hardcoded role enum (admin/operator/cashier/readonly, checked
literally as requireRole("admin",...) across ~15 routes) with dynamic RBAC:
roles are DATA, route guards check a PERMISSION.
@parking/shared defines a code-defined grid: RESOURCES (user/role/tariff/
subscription/site/device/shift/payment/session/event/report) × Action
(create/read/update/delete + domain verbs void/cash) -> PERMISSIONS
(resource:action, e.g. tariff:update, payment:create, event:void).
DB: new roles + role_permissions tables; users.role enum -> role_id FK;
migration 0007_rbac (create tables, seed the builtin admin role + all 26
perms, seed operator/cashier/readonly composable roles matching old
behaviour, rebuild users to swap the column copying all rows).
auth.ts: JWT payload role -> roleId; permissionsFor(roleId) with an
in-memory cache + bumpPermsCache(); requirePermission(...perms) preHandler;
requireAuth for /me & /language; initAuth(db) wires the resolver once. Every
route guard mapped to a permission; device ingress (devices/qr-reader) stays
auth-free by design. New routes/users.ts (user:* CRUD, bcrypt 12, last-admin
guard) + routes/roles.ts (role:* CRUD, builtin-protected, perms validated
against the grid, cache bump on write). auth/me + /login return
{roleId, roleName, permissions, language}. seed-admin -> roleId:'admin'.
Frontend: SessionUser carries permissions + can() helper; router nav/route
guards gate by permission (requirePerm replaces adminOnly); SiteSettings
edit gated by site:update; new UsersManager + RolesManager (permission
checkbox grid; admin role locked); i18n nav.users/roles + blocks (sq+en).
Decisions: one role per user; protected built-in admin (no-lockout: the last
admin can't be deleted/downgraded); JWT carries roleId, perms resolved
per-request so role edits apply immediately (no re-login).
Verified: full build green; 20-assertion inject test passes (cashier 403s on
tariff publish + user list, admin passes, granting a perm applies on the next
request, last-admin + builtin-role protections return 409); migration 0007
applied to a copy of the live DB (incl WAL/shm) — existing admin maps to
role_id='admin', all rows preserved. Append-only event chain untouched
(event:void gates appending a void, not a delete).
Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V
104 lines
4.5 KiB
SQL
104 lines
4.5 KiB
SQL
-- Dynamic RBAC: roles become DATA. Replaces the hardcoded users.role enum with a
|
|
-- role_id FK into a composable `roles` table + a `role_permissions` grid.
|
|
-- See wiki/entities/local-jwt-auth.md and @parking/shared PERMISSIONS.
|
|
|
|
-- 1. Roles + the role→permission grid.
|
|
CREATE TABLE `roles` (
|
|
`id` text PRIMARY KEY NOT NULL,
|
|
`name` text NOT NULL,
|
|
`builtin` integer DEFAULT 0 NOT NULL,
|
|
`created_at` text DEFAULT (current_timestamp) NOT NULL
|
|
);
|
|
--> statement-breakpoint
|
|
CREATE UNIQUE INDEX `roles_name_unique` ON `roles` (`name`);
|
|
--> statement-breakpoint
|
|
CREATE TABLE `role_permissions` (
|
|
`role_id` text NOT NULL,
|
|
`permission` text NOT NULL,
|
|
FOREIGN KEY (`role_id`) REFERENCES `roles`(`id`) ON UPDATE no action ON DELETE no action
|
|
);
|
|
--> statement-breakpoint
|
|
CREATE UNIQUE INDEX `role_permissions_role_id_permission_unique` ON `role_permissions` (`role_id`,`permission`);
|
|
--> statement-breakpoint
|
|
|
|
-- 2. Seed the protected built-in `admin` role. Its permission set is enforced in
|
|
-- code (always ALL), but we materialise the rows too so the grid is complete.
|
|
INSERT INTO `roles` (`id`, `name`, `builtin`) VALUES ('admin', 'Admin', 1);
|
|
--> statement-breakpoint
|
|
INSERT INTO `role_permissions` (`role_id`, `permission`) VALUES
|
|
('admin','user:create'),('admin','user:read'),('admin','user:update'),('admin','user:delete'),
|
|
('admin','role:create'),('admin','role:read'),('admin','role:update'),('admin','role:delete'),
|
|
('admin','tariff:read'),('admin','tariff:update'),
|
|
('admin','subscription:read'),('admin','subscription:create'),('admin','subscription:update'),('admin','subscription:delete'),
|
|
('admin','site:read'),('admin','site:update'),
|
|
('admin','device:read'),
|
|
('admin','shift:read'),('admin','shift:create'),('admin','shift:cash'),
|
|
('admin','payment:read'),('admin','payment:create'),
|
|
('admin','session:read'),
|
|
('admin','event:read'),('admin','event:void'),
|
|
('admin','report:read');
|
|
--> statement-breakpoint
|
|
|
|
-- 3. Seed composable roles matching the OLD enum's intended behaviour, so any
|
|
-- existing operator/cashier/readonly user keeps working. These are ordinary
|
|
-- (non-builtin) rows an admin may later edit or delete.
|
|
INSERT INTO `roles` (`id`, `name`, `builtin`) VALUES ('operator', 'Operator', 0);
|
|
--> statement-breakpoint
|
|
INSERT INTO `role_permissions` (`role_id`, `permission`) VALUES
|
|
('operator','payment:read'),('operator','payment:create'),
|
|
('operator','session:read'),
|
|
('operator','shift:read'),('operator','shift:create'),
|
|
('operator','subscription:read'),
|
|
('operator','tariff:read'),
|
|
('operator','site:read'),
|
|
('operator','device:read'),
|
|
('operator','event:read'),
|
|
('operator','report:read');
|
|
--> statement-breakpoint
|
|
INSERT INTO `roles` (`id`, `name`, `builtin`) VALUES ('cashier', 'Cashier', 0);
|
|
--> statement-breakpoint
|
|
INSERT INTO `role_permissions` (`role_id`, `permission`) VALUES
|
|
('cashier','payment:read'),('cashier','payment:create'),
|
|
('cashier','session:read'),
|
|
('cashier','shift:read'),('cashier','shift:create'),
|
|
('cashier','subscription:read'),
|
|
('cashier','tariff:read'),
|
|
('cashier','site:read'),
|
|
('cashier','device:read'),
|
|
('cashier','event:read'),
|
|
('cashier','report:read');
|
|
--> statement-breakpoint
|
|
INSERT INTO `roles` (`id`, `name`, `builtin`) VALUES ('readonly', 'Read-only', 0);
|
|
--> statement-breakpoint
|
|
INSERT INTO `role_permissions` (`role_id`, `permission`) VALUES
|
|
('readonly','session:read'),
|
|
('readonly','subscription:read'),
|
|
('readonly','tariff:read'),
|
|
('readonly','site:read'),
|
|
('readonly','device:read'),
|
|
('readonly','event:read'),
|
|
('readonly','report:read');
|
|
--> statement-breakpoint
|
|
|
|
-- 4. Rebuild `users` to swap the `role` enum column for a `role_id` FK. SQLite
|
|
-- can't DROP a column cleanly, so: create the new shape, copy rows mapping the
|
|
-- old role string -> role id (identical strings), drop, rename.
|
|
CREATE TABLE `users_new` (
|
|
`id` text PRIMARY KEY NOT NULL,
|
|
`username` text NOT NULL,
|
|
`password_hash` text NOT NULL,
|
|
`role_id` text NOT NULL,
|
|
`language` text DEFAULT 'sq' NOT NULL,
|
|
`created_at` text DEFAULT (current_timestamp) NOT NULL,
|
|
FOREIGN KEY (`role_id`) REFERENCES `roles`(`id`) ON UPDATE no action ON DELETE no action
|
|
);
|
|
--> statement-breakpoint
|
|
INSERT INTO `users_new` (`id`, `username`, `password_hash`, `role_id`, `language`, `created_at`)
|
|
SELECT `id`, `username`, `password_hash`, `role`, `language`, `created_at` FROM `users`;
|
|
--> statement-breakpoint
|
|
DROP TABLE `users`;
|
|
--> statement-breakpoint
|
|
ALTER TABLE `users_new` RENAME TO `users`;
|
|
--> statement-breakpoint
|
|
CREATE UNIQUE INDEX `users_username_unique` ON `users` (`username`);
|