Browse Source
- Introduced a role-based visibility system for products, ensuring that only users with approved roles can view specific products. - Added new database tables for roles, user roles, and product role visibility to manage access control. - Implemented utility functions for role management, including fetching approved roles, checking product visibility, and assigning roles to users and products. - Updated API endpoints to filter products based on user roles, enhancing security and user experience. - Prepared the database schema for future role request and approval workflows in upcoming phases.main
Bastian Masanek
2 months ago
10 changed files with 1865 additions and 26 deletions
@ -0,0 +1,43 @@ |
|||||
|
CREATE TYPE "public"."role_code" AS ENUM('private', 'educator', 'company');--> statement-breakpoint |
||||
|
CREATE TYPE "public"."role_request_status" AS ENUM('pending', 'approved', 'rejected');--> statement-breakpoint |
||||
|
CREATE TABLE "product_role_visibility" ( |
||||
|
"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL, |
||||
|
"product_id" uuid NOT NULL, |
||||
|
"role_id" uuid NOT NULL, |
||||
|
"created_at" timestamp DEFAULT now() NOT NULL |
||||
|
); |
||||
|
--> statement-breakpoint |
||||
|
CREATE TABLE "roles" ( |
||||
|
"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL, |
||||
|
"code" "role_code" NOT NULL, |
||||
|
"display_name" text NOT NULL, |
||||
|
"description" text NOT NULL, |
||||
|
"requires_approval" boolean DEFAULT false NOT NULL, |
||||
|
"sort_order" integer DEFAULT 0 NOT NULL, |
||||
|
"active" boolean DEFAULT true NOT NULL, |
||||
|
"created_at" timestamp DEFAULT now() NOT NULL, |
||||
|
"updated_at" timestamp DEFAULT now() NOT NULL, |
||||
|
CONSTRAINT "roles_code_unique" UNIQUE("code") |
||||
|
); |
||||
|
--> statement-breakpoint |
||||
|
CREATE TABLE "user_roles" ( |
||||
|
"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL, |
||||
|
"user_id" uuid NOT NULL, |
||||
|
"role_id" uuid NOT NULL, |
||||
|
"status" "role_request_status" DEFAULT 'pending' NOT NULL, |
||||
|
"organization_name" text, |
||||
|
"admin_notes" text, |
||||
|
"status_history" jsonb DEFAULT '[]' NOT NULL, |
||||
|
"created_at" timestamp DEFAULT now() NOT NULL, |
||||
|
"updated_at" timestamp DEFAULT now() NOT NULL |
||||
|
); |
||||
|
--> statement-breakpoint |
||||
|
ALTER TABLE "product_role_visibility" ADD CONSTRAINT "product_role_visibility_product_id_products_id_fk" FOREIGN KEY ("product_id") REFERENCES "public"."products"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint |
||||
|
ALTER TABLE "product_role_visibility" ADD CONSTRAINT "product_role_visibility_role_id_roles_id_fk" FOREIGN KEY ("role_id") REFERENCES "public"."roles"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint |
||||
|
ALTER TABLE "user_roles" ADD CONSTRAINT "user_roles_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint |
||||
|
ALTER TABLE "user_roles" ADD CONSTRAINT "user_roles_role_id_roles_id_fk" FOREIGN KEY ("role_id") REFERENCES "public"."roles"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint |
||||
|
CREATE INDEX "product_role_visibility_product_id_role_id_unique" ON "product_role_visibility" USING btree ("product_id","role_id");--> statement-breakpoint |
||||
|
CREATE INDEX "product_role_visibility_product_id_idx" ON "product_role_visibility" USING btree ("product_id");--> statement-breakpoint |
||||
|
CREATE INDEX "user_roles_user_id_role_id_unique" ON "user_roles" USING btree ("user_id","role_id");--> statement-breakpoint |
||||
|
CREATE INDEX "user_roles_user_id_idx" ON "user_roles" USING btree ("user_id");--> statement-breakpoint |
||||
|
CREATE INDEX "user_roles_status_idx" ON "user_roles" USING btree ("status"); |
||||
File diff suppressed because it is too large
@ -0,0 +1,261 @@ |
|||||
|
/** |
||||
|
* Role Management Utilities |
||||
|
* |
||||
|
* Helper functions for managing user roles and product visibility. |
||||
|
* MVP: These functions work with manually assigned roles (status='approved') |
||||
|
* Phase 2/3: Will be extended to handle role request/approval workflow |
||||
|
*/ |
||||
|
|
||||
|
import { and, eq, inArray } from 'drizzle-orm' |
||||
|
import type { SQL } from 'drizzle-orm' |
||||
|
import { roles, userRoles, productRoleVisibility } from '../database/schema' |
||||
|
|
||||
|
/** |
||||
|
* Get all approved roles for a user |
||||
|
* MVP: Returns roles with status='approved' (manually assigned via DB) |
||||
|
* Phase 2/3: Used to check which products a user can see |
||||
|
* |
||||
|
* @param userId - The user's UUID |
||||
|
* @returns Array of role objects with full details |
||||
|
*/ |
||||
|
export async function getUserApprovedRoles(userId: string) { |
||||
|
const db = useDatabase() |
||||
|
|
||||
|
const approvedRoles = await db.query.userRoles.findMany({ |
||||
|
where: and(eq(userRoles.userId, userId), eq(userRoles.status, 'approved')), |
||||
|
with: { |
||||
|
role: true, |
||||
|
}, |
||||
|
}) |
||||
|
|
||||
|
return approvedRoles.map((ur) => ur.role) |
||||
|
} |
||||
|
|
||||
|
/** |
||||
|
* Get approved role codes for a user (lightweight version) |
||||
|
* Returns just the role codes ['private', 'educator'] instead of full objects |
||||
|
* |
||||
|
* @param userId - The user's UUID |
||||
|
* @returns Array of role codes |
||||
|
*/ |
||||
|
export async function getUserApprovedRoleCodes(userId: string): Promise<string[]> { |
||||
|
const approvedRoles = await getUserApprovedRoles(userId) |
||||
|
return approvedRoles.map((role) => role.code) |
||||
|
} |
||||
|
|
||||
|
/** |
||||
|
* Check if a specific product is visible to a user based on their roles |
||||
|
* |
||||
|
* Logic: |
||||
|
* - If product has NO role assignments → NOT visible (opt-in visibility) |
||||
|
* - If product HAS role assignments → visible only if user has at least one matching role |
||||
|
* |
||||
|
* @param productId - The product's UUID |
||||
|
* @param userId - The user's UUID |
||||
|
* @returns true if user can see the product, false otherwise |
||||
|
*/ |
||||
|
export async function isProductVisibleForUser( |
||||
|
productId: string, |
||||
|
userId: string |
||||
|
): Promise<boolean> { |
||||
|
const db = useDatabase() |
||||
|
|
||||
|
// Get user's approved role codes
|
||||
|
const userRoleCodes = await getUserApprovedRoleCodes(userId) |
||||
|
|
||||
|
// Get product's role visibility assignments
|
||||
|
const productRoles = await db.query.productRoleVisibility.findMany({ |
||||
|
where: eq(productRoleVisibility.productId, productId), |
||||
|
with: { |
||||
|
role: true, |
||||
|
}, |
||||
|
}) |
||||
|
|
||||
|
// No role assignments → product is NOT visible (opt-in)
|
||||
|
if (productRoles.length === 0) { |
||||
|
return false |
||||
|
} |
||||
|
|
||||
|
// Check if user has at least one matching role
|
||||
|
const productRoleCodes = productRoles.map((pr) => pr.role.code) |
||||
|
return productRoleCodes.some((code) => userRoleCodes.includes(code)) |
||||
|
} |
||||
|
|
||||
|
/** |
||||
|
* Get all products visible to a user based on their roles |
||||
|
* Returns a WHERE clause that can be used with Drizzle queries |
||||
|
* |
||||
|
* Usage: |
||||
|
* ```typescript
|
||||
|
* const visibleProductIds = await getVisibleProductIdsForUser(userId) |
||||
|
* const products = await db.query.products.findMany({ |
||||
|
* where: inArray(products.id, visibleProductIds) |
||||
|
* }) |
||||
|
* ``` |
||||
|
* |
||||
|
* @param userId - The user's UUID |
||||
|
* @returns Array of product UUIDs that the user can see |
||||
|
*/ |
||||
|
export async function getVisibleProductIdsForUser(userId: string): Promise<string[]> { |
||||
|
const db = useDatabase() |
||||
|
|
||||
|
// Get user's approved role IDs
|
||||
|
const userRoleRecords = await db.query.userRoles.findMany({ |
||||
|
where: and(eq(userRoles.userId, userId), eq(userRoles.status, 'approved')), |
||||
|
}) |
||||
|
|
||||
|
const userRoleIds = userRoleRecords.map((ur) => ur.roleId) |
||||
|
|
||||
|
// If user has no approved roles, they can't see any products
|
||||
|
if (userRoleIds.length === 0) { |
||||
|
return [] |
||||
|
} |
||||
|
|
||||
|
// Get all products assigned to these roles
|
||||
|
const visibleProducts = await db.query.productRoleVisibility.findMany({ |
||||
|
where: inArray(productRoleVisibility.roleId, userRoleIds), |
||||
|
}) |
||||
|
|
||||
|
// Return unique product IDs
|
||||
|
return [...new Set(visibleProducts.map((pv) => pv.productId))] |
||||
|
} |
||||
|
|
||||
|
/** |
||||
|
* Assign a role to a user (MVP: manual assignment, always approved) |
||||
|
* Phase 2/3: This will be replaced by role request workflow |
||||
|
* |
||||
|
* @param userId - The user's UUID |
||||
|
* @param roleCode - Role code ('private', 'educator', 'company') |
||||
|
* @param options - Optional metadata (organization name, admin notes) |
||||
|
*/ |
||||
|
export async function assignRoleToUser( |
||||
|
userId: string, |
||||
|
roleCode: 'private' | 'educator' | 'company', |
||||
|
options?: { |
||||
|
organizationName?: string |
||||
|
adminNotes?: string |
||||
|
} |
||||
|
) { |
||||
|
const db = useDatabase() |
||||
|
|
||||
|
// Find role by code
|
||||
|
const role = await db.query.roles.findFirst({ |
||||
|
where: eq(roles.code, roleCode), |
||||
|
}) |
||||
|
|
||||
|
if (!role) { |
||||
|
throw new Error(`Role '${roleCode}' not found`) |
||||
|
} |
||||
|
|
||||
|
// Check if user already has this role
|
||||
|
const existing = await db.query.userRoles.findFirst({ |
||||
|
where: and(eq(userRoles.userId, userId), eq(userRoles.roleId, role.id)), |
||||
|
}) |
||||
|
|
||||
|
if (existing) { |
||||
|
throw new Error(`User already has role '${roleCode}'`) |
||||
|
} |
||||
|
|
||||
|
// Create user role assignment (approved in MVP)
|
||||
|
const [userRole] = await db |
||||
|
.insert(userRoles) |
||||
|
.values({ |
||||
|
userId, |
||||
|
roleId: role.id, |
||||
|
status: 'approved', // MVP: Always approved
|
||||
|
organizationName: options?.organizationName, |
||||
|
adminNotes: options?.adminNotes, |
||||
|
statusHistory: [ |
||||
|
{ |
||||
|
status: 'approved', |
||||
|
organizationName: options?.organizationName || null, |
||||
|
adminNotes: options?.adminNotes || null, |
||||
|
changedAt: new Date().toISOString(), |
||||
|
changedBy: null, // MVP: Manual assignment (no admin tracking)
|
||||
|
}, |
||||
|
], |
||||
|
}) |
||||
|
.returning() |
||||
|
|
||||
|
return userRole |
||||
|
} |
||||
|
|
||||
|
/** |
||||
|
* Get role by code (helper function) |
||||
|
* |
||||
|
* @param roleCode - Role code ('private', 'educator', 'company') |
||||
|
* @returns Role object or null if not found |
||||
|
*/ |
||||
|
export async function getRoleByCode(roleCode: 'private' | 'educator' | 'company') { |
||||
|
const db = useDatabase() |
||||
|
|
||||
|
return await db.query.roles.findFirst({ |
||||
|
where: eq(roles.code, roleCode), |
||||
|
}) |
||||
|
} |
||||
|
|
||||
|
/** |
||||
|
* Assign roles to a product based on category (for ERP import) |
||||
|
* |
||||
|
* Category Mapping: |
||||
|
* - 'makerspace-annual-pass' → ['private', 'educator'] |
||||
|
* - 'annual-pass' → ['private'] |
||||
|
* - 'educator-annual-pass' → ['educator'] |
||||
|
* - 'company-annual-pass' → ['company'] |
||||
|
* |
||||
|
* @param productId - The product's UUID |
||||
|
* @param category - Product category from NAV ERP |
||||
|
*/ |
||||
|
export async function assignRolesToProductByCategory( |
||||
|
productId: string, |
||||
|
category: string |
||||
|
) { |
||||
|
const db = useDatabase() |
||||
|
|
||||
|
// Category to role mapping
|
||||
|
const categoryRoleMapping: Record<string, Array<'private' | 'educator' | 'company'>> = { |
||||
|
'makerspace-annual-pass': ['private', 'educator'], |
||||
|
'annual-pass': ['private'], |
||||
|
'educator-annual-pass': ['educator'], |
||||
|
'company-annual-pass': ['company'], |
||||
|
} |
||||
|
|
||||
|
const roleCodes = categoryRoleMapping[category] || [] |
||||
|
|
||||
|
if (roleCodes.length === 0) { |
||||
|
console.warn(`No role mapping found for category '${category}'`) |
||||
|
return [] |
||||
|
} |
||||
|
|
||||
|
// Get role IDs
|
||||
|
const roleRecords = await db.query.roles.findMany({ |
||||
|
where: inArray(roles.code, roleCodes), |
||||
|
}) |
||||
|
|
||||
|
const assignments = [] |
||||
|
|
||||
|
// Create product-role assignments
|
||||
|
for (const role of roleRecords) { |
||||
|
// Check if assignment already exists
|
||||
|
const existing = await db.query.productRoleVisibility.findFirst({ |
||||
|
where: and( |
||||
|
eq(productRoleVisibility.productId, productId), |
||||
|
eq(productRoleVisibility.roleId, role.id) |
||||
|
), |
||||
|
}) |
||||
|
|
||||
|
if (!existing) { |
||||
|
const [assignment] = await db |
||||
|
.insert(productRoleVisibility) |
||||
|
.values({ |
||||
|
productId, |
||||
|
roleId: role.id, |
||||
|
}) |
||||
|
.returning() |
||||
|
|
||||
|
assignments.push(assignment) |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
return assignments |
||||
|
} |
||||
Loading…
Reference in new issue