@hed-hog/operations 0.0.303 → 0.0.305

package/src/services/shared/operations-access.service.ts

@@ -0,0 +1,52 @@
+import { ForbiddenException, Injectable } from '@nestjs/common';
+
+type AccessActorContext = {
+  isDirector: boolean;
+  isSupervisor: boolean;
+  isCollaborator: boolean;
+  visibleCollaboratorIds: number[];
+  visibleProjectIds: number[];
+};
+
+@Injectable()
+export class OperationsAccessService {
+  ensureDirector(actor: AccessActorContext) {
+    if (!actor.isDirector) {
+      throw new ForbiddenException('Director access is required.');
+    }
+  }
+
+  ensureSupervisor(actor: AccessActorContext) {
+    if (!actor.isSupervisor) {
+      throw new ForbiddenException('Supervisor access is required.');
+    }
+  }
+
+  ensureCollaborator(actor: AccessActorContext) {
+    if (!actor.isCollaborator) {
+      throw new ForbiddenException('Operations collaborator access is required.');
+    }
+  }
+
+  ensureCollaboratorAccess(actor: AccessActorContext, collaboratorId: number) {
+    if (actor.isDirector) {
+      return;
+    }
+
+    if (!actor.visibleCollaboratorIds.includes(collaboratorId)) {
+      throw new ForbiddenException(
+        'You do not have access to this collaborator.'
+      );
+    }
+  }
+
+  ensureProjectAccess(actor: AccessActorContext, projectId: number) {
+    if (actor.isDirector) {
+      return;
+    }
+
+    if (!actor.visibleProjectIds.includes(projectId)) {
+      throw new ForbiddenException('You do not have access to this project.');
+    }
+  }
+}