fix installer

internal/role/role.go

@@ -0,0 +1,175 @@
+// Package role defines the tenant membership roles and the single permission
+// matrix that authorizes console and management behavior.
+//
+// Roles are stored in memberships.role. Authorization decisions must derive
+// from Grants or Allows so that SQL role checks and Go checks cannot drift
+// apart.
+package role
+
+// Role is a tenant membership role.
+type Role string
+
+const (
+	// Owner has full control of a tenant, including tenant-level settings.
+	Owner Role = "owner"
+	// Admin manages applications, credentials, contracts, and members.
+	Admin Role = "admin"
+	// Developer manages applications, credentials, and contracts.
+	Developer Role = "developer"
+	// Operator issues and revokes credentials and imports contracts.
+	Operator Role = "operator"
+	// Viewer reads the console without changing anything.
+	Viewer Role = "viewer"
+	// User is a self-service member. It carries no console access and exists so
+	// that end users of client applications still hold a tenant role that
+	// applications can read through /connect/userinfo.
+	User Role = "user"
+)
+
+// Permission is a capability granted by a role.
+type Permission string
+
+const (
+	ReadConsole        Permission = "console.read"
+	ReadUsers          Permission = "users.read"
+	ManageApplications Permission = "applications.manage"
+	ManageKeys         Permission = "keys.manage"
+	ManageContracts    Permission = "contracts.manage"
+	ManageUsers        Permission = "users.manage"
+	ManageTenants      Permission = "tenants.manage"
+	EditProfile        Permission = "profile.edit"
+)
+
+// catalog lists every role in descending order of privilege.
+var catalog = []Role{Owner, Admin, Developer, Operator, Viewer, User}
+
+// grants is the permission matrix. ReadConsole is deliberately absent for User
+// so that self-service members are routed to the profile screen instead of the
+// management console.
+var grants = map[Role]map[Permission]bool{
+	Owner: {
+		ReadConsole: true, ReadUsers: true, ManageApplications: true, ManageKeys: true,
+		ManageContracts: true, ManageUsers: true, ManageTenants: true, EditProfile: true,
+	},
+	Admin: {
+		ReadConsole: true, ReadUsers: true, ManageApplications: true, ManageKeys: true,
+		ManageContracts: true, ManageUsers: true, EditProfile: true,
+	},
+	Developer: {
+		ReadConsole: true, ReadUsers: true, ManageApplications: true, ManageKeys: true,
+		ManageContracts: true, EditProfile: true,
+	},
+	Operator: {
+		ReadConsole: true, ReadUsers: true, ManageKeys: true, ManageContracts: true, EditProfile: true,
+	},
+	Viewer: {
+		ReadConsole: true, ReadUsers: true, EditProfile: true,
+	},
+	User: {
+		EditProfile: true,
+	},
+}
+
+var ordered = []Permission{
+	ReadConsole, ReadUsers, ManageApplications, ManageKeys,
+	ManageContracts, ManageUsers, ManageTenants, EditProfile,
+}
+
+// Entry describes a role for the console and for API clients.
+type Entry struct {
+	Value       string   `json:"value"`
+	Label       string   `json:"label"`
+	Permissions []string `json:"permissions"`
+}
+
+var labels = map[Role]string{
+	Owner:     "Owner",
+	Admin:     "Administrator",
+	Developer: "Developer",
+	Operator:  "Operator",
+	Viewer:    "Viewer",
+	User:      "User",
+}
+
+// All returns every role ordered from most to least privileged.
+func All() []Role {
+	result := make([]Role, len(catalog))
+	copy(result, catalog)
+	return result
+}
+
+// Catalog returns every role with its label and permissions so that the console
+// and API clients never hardcode the role list.
+func Catalog() []Entry {
+	result := make([]Entry, 0, len(catalog))
+	for _, item := range catalog {
+		result = append(result, Entry{Value: string(item), Label: labels[item], Permissions: item.Permissions()})
+	}
+	return result
+}
+
+// Parse converts a stored or submitted value into a Role.
+func Parse(value string) (Role, bool) {
+	candidate := Role(value)
+	if _, known := grants[candidate]; !known {
+		return "", false
+	}
+	return candidate, true
+}
+
+// Valid reports whether the value names a role.
+func (r Role) Valid() bool {
+	_, known := grants[r]
+	return known
+}
+
+// Allows reports whether the role grants the permission.
+func (r Role) Allows(permission Permission) bool {
+	return grants[r][permission]
+}
+
+// Permissions returns the role's permissions in a stable order.
+func (r Role) Permissions() []string {
+	result := make([]string, 0, len(ordered))
+	for _, permission := range ordered {
+		if r.Allows(permission) {
+			result = append(result, string(permission))
+		}
+	}
+	return result
+}
+
+// Grants returns the roles that grant a permission, for use as a SQL parameter
+// so that role checks in queries stay aligned with this matrix.
+func Grants(permission Permission) []string {
+	result := make([]string, 0, len(catalog))
+	for _, item := range catalog {
+		if item.Allows(permission) {
+			result = append(result, string(item))
+		}
+	}
+	return result
+}
+
+// Grantable returns the roles a tenant administrator may hand to a new member.
+// Ownership is not grantable during an invitation because it is established by
+// creating or claiming a tenant.
+func Grantable() []Role {
+	result := make([]Role, 0, len(catalog)-1)
+	for _, item := range catalog {
+		if item != Owner {
+			result = append(result, item)
+		}
+	}
+	return result
+}
+
+// GrantableValues returns Grantable as strings for a request payload.
+func GrantableValues() []string {
+	values := Grantable()
+	result := make([]string, len(values))
+	for index, item := range values {
+		result[index] = string(item)
+	}
+	return result
+}