auth

Main authentication module for my projects
git clone git://git.finwo.net/app/auth
Log | Files | Refs

policy.js (1347B)

      1 export function isRealmAdmin(roles) {
      2   return Array.isArray(roles) && roles.includes('realm-admin');
      3 }
      4 
      5 export function isSystemAdmin(user) {
      6   return Boolean(user?.is_system_admin);
      7 }
      8 
      9 export function canUseClient({ user, membership, roles, client, realm }) {
     10   if (!user || user.status !== 'active') return false;
     11   if (!client || !client.enabled) return false;
     12 
     13   const requiredRoles = Array.isArray(client.required_roles) ? client.required_roles : [];
     14   const roleOk = requiredRoles.length === 0 || requiredRoles.some((role) => roles.includes(role));
     15 
     16   if (client.virtual && client.client_id === 'admin') {
     17     if (isSystemAdmin(user)) return true;
     18     return Boolean(membership && membership.status === 'active' && roles.includes('realm-admin'));
     19   }
     20 
     21   if (client.access_mode === 'public') return true;
     22 
     23   if (!membership || membership.status !== 'active') return false;
     24 
     25   if (client.access_mode === 'internal') {
     26     return user.home_realm_id === realm.id && roleOk;
     27   }
     28 
     29   if (client.access_mode === 'members') {
     30     return roleOk;
     31   }
     32 
     33   return false;
     34 }
     35 
     36 export function canManageUser({ actorRoles, actorIsSystemAdmin, target, realmId }) {
     37   if (actorIsSystemAdmin) return 'full';
     38   if (!isRealmAdmin(actorRoles)) return null;
     39   if (!target) return null;
     40   if (target.home_realm_id === realmId) return 'full';
     41   return 'membership';
     42 }