@omersx/bemms 0.0.0-stage → 0.1.0

package/src/lib/actions/notifications.ts

@@ -0,0 +1,136 @@
+'use server';
+
+import { db } from '@/lib/db';
+import { notifications, pushSubscriptions, users } from '@/lib/db/schema';
+import { requireAuth } from '@/lib/auth/rbac';
+import { eq, and, isNull, desc, sql } from 'drizzle-orm';
+
+export async function getUnreadCount() {
+  const user = await requireAuth();
+
+  const result = await db.select({
+    count: sql<number>`count(*)::int`,
+  })
+  .from(notifications)
+  .where(and(
+    eq(notifications.recipientUserId, user.id),
+    isNull(notifications.readAt),
+  ));
+
+  return result[0]?.count || 0;
+}
+
+export async function getNotifications(limit = 20, offset = 0) {
+  const user = await requireAuth();
+
+  return db.query.notifications.findMany({
+    where: eq(notifications.recipientUserId, user.id),
+    orderBy: [desc(notifications.createdAt)],
+    limit,
+    offset,
+  });
+}
+
+export async function markAsRead(notificationId: string) {
+  const user = await requireAuth();
+
+  await db.update(notifications)
+    .set({ readAt: new Date() })
+    .where(and(
+      eq(notifications.id, notificationId),
+      eq(notifications.recipientUserId, user.id),
+    ));
+}
+
+export async function markAllAsRead() {
+  const user = await requireAuth();
+
+  await db.update(notifications)
+    .set({ readAt: new Date() })
+    .where(and(
+      eq(notifications.recipientUserId, user.id),
+      isNull(notifications.readAt),
+    ));
+}
+
+export async function savePushSubscription(subscription: {
+  endpoint: string;
+  keys: { p256dh: string; auth: string };
+  userAgent?: string;
+}) {
+  const user = await requireAuth();
+
+  // Check if subscription already exists
+  const existing = await db.query.pushSubscriptions.findFirst({
+    where: eq(pushSubscriptions.endpoint, subscription.endpoint),
+  });
+
+  if (existing) {
+    // Update existing
+    await db.update(pushSubscriptions)
+      .set({
+        p256dh: subscription.keys.p256dh,
+        auth: subscription.keys.auth,
+        userId: user.id,
+      })
+      .where(eq(pushSubscriptions.id, existing.id));
+    return existing;
+  }
+
+  // Create new
+  const [sub] = await db.insert(pushSubscriptions).values({
+    userId: user.id,
+    endpoint: subscription.endpoint,
+    p256dh: subscription.keys.p256dh,
+    auth: subscription.keys.auth,
+    userAgent: subscription.userAgent,
+  }).returning();
+
+  return sub;
+}
+
+export async function removePushSubscription(endpoint: string) {
+  const user = await requireAuth();
+
+  await db.delete(pushSubscriptions)
+    .where(and(
+      eq(pushSubscriptions.endpoint, endpoint),
+      eq(pushSubscriptions.userId, user.id),
+    ));
+}
+
+export async function updateNotificationPreferences(prefs: {
+  pushEnabled: boolean;
+  categories: {
+    tickets: boolean;
+    maintenance: boolean;
+    devices: boolean;
+    system: boolean;
+  };
+}) {
+  const user = await requireAuth();
+
+  await db.update(users)
+    .set({ notificationPreferences: prefs })
+    .where(eq(users.id, user.id));
+}
+
+export async function getNotificationPreferences() {
+  const user = await requireAuth();
+
+  const userData = await db.query.users.findFirst({
+    where: eq(users.id, user.id),
+    columns: { notificationPreferences: true },
+  });
+
+  return userData?.notificationPreferences || {
+    pushEnabled: true,
+    categories: {
+      tickets: true,
+      maintenance: true,
+      devices: true,
+      system: true,
+    },
+  };
+}
+

package/src/lib/actions/organizations.ts

@@ -0,0 +1,99 @@
+'use server';
+
+import { db } from '@/lib/db';
+import { organizations } from '@/lib/db/schema';
+import { requireAuth, requireRole } from '@/lib/auth/rbac';
+import { createAuditLog } from '@/lib/audit';
+import { createOrganizationSchema, updateOrganizationSchema } from '@/lib/validators/organizations';
+import { eq } from 'drizzle-orm';
+
+export async function getOrganizations() {
+  await requireAuth();
+  await requireRole('SYS_ADMIN', 'ORG_ADMIN');
+  try {
+    const data = await db.query.organizations.findMany();
+    return { success: true, data };
+  } catch (error: any) {
+    return { success: false, error: error.message };
+  }
+}
+
+export async function getOrganizationById(id: string) {
+  await requireAuth();
+  await requireRole('SYS_ADMIN', 'ORG_ADMIN');
+  try {
+    const data = await db.query.organizations.findFirst({
+      where: eq(organizations.id, id),
+    });
+    return { success: true, data };
+  } catch (error: any) {
+    return { success: false, error: error.message };
+  }
+}
+
+export async function createOrganization(input: unknown) {
+  const session = await requireAuth();
+  await requireRole('SYS_ADMIN');
+  const validated = createOrganizationSchema.safeParse(input);
+  if (!validated.success) return { success: false, error: validated.error.message };
+
+  try {
+    return await db.transaction(async (tx) => {
+      const [newOrg] = await tx.insert(organizations).values(validated.data).returning();
+      await createAuditLog(tx, {
+        action: 'CREATE',
+        entityType: 'organization',
+        entityId: newOrg.id,
+        actorId: session.id,
+        details: validated.data,
+      });
+      return { success: true, data: newOrg };
+    });
+  } catch (error: any) {
+    return { success: false, error: error.message };
+  }
+}
+
+export async function updateOrganization(id: string, input: unknown) {
+  const session = await requireAuth();
+  await requireRole('SYS_ADMIN', 'ORG_ADMIN');
+  const validated = updateOrganizationSchema.safeParse(input);
+  if (!validated.success) return { success: false, error: validated.error.message };
+
+  try {
+    return await db.transaction(async (tx) => {
+      const [updated] = await tx.update(organizations).set(validated.data).where(eq(organizations.id, id)).returning();
+      await createAuditLog(tx, {
+        action: 'UPDATE',
+        entityType: 'organization',
+        entityId: id,
+        actorId: session.id,
+        details: validated.data,
+      });
+      return { success: true, data: updated };
+    });
+  } catch (error: any) {
+    return { success: false, error: error.message };
+  }
+}
+
+export async function archiveOrganization(id: string) {
+  const session = await requireAuth();
+  await requireRole('SYS_ADMIN');
+  try {
+    return await db.transaction(async (tx) => {
+      const [archived] = await tx.update(organizations).set({ status: 'archived' }).where(eq(organizations.id, id)).returning();
+      await createAuditLog(tx, {
+        action: 'ARCHIVE',
+        entityType: 'organization',
+        entityId: id,
+        actorId: session.id,
+        details: { status: 'archived' },
+      });
+      return { success: true, data: archived };
+    });
+  } catch (error: any) {
+    return { success: false, error: error.message };
+  }
+}
+

package/src/lib/actions/qr.ts

@@ -0,0 +1,147 @@
+'use server';
+
+import { db } from '@/lib/db';
+import { deviceQrLabels, devices } from '@/lib/db/schema';
+import { requireAuth, requireRole } from '@/lib/auth/rbac';
+import { createAuditLog } from '@/lib/audit';
+import { eq, and, desc } from 'drizzle-orm';
+import { nanoid } from 'nanoid';
+
+function generateOpaqueReference(): string {
+  return `dv_${nanoid(10)}`;
+}
+
+export async function getActiveQrLabel(deviceId: string) {
+  await requireAuth();
+  try {
+    const data = await db.query.deviceQrLabels.findFirst({
+      where: and(
+        eq(deviceQrLabels.deviceId, deviceId),
+        eq(deviceQrLabels.labelStatus, 'active'),
+      ),
+    });
+    return { success: true, data };
+  } catch (error: any) {
+    return { success: false, error: error.message };
+  }
+}
+
+export async function generateNewQrLabel(deviceId: string, reason?: string) {
+  const session = await requireAuth();
+  await requireRole('SYS_ADMIN', 'BIOMED_MGR', 'BIOMED_ENG');
+
+  try {
+    const device = await db.query.devices.findFirst({ where: eq(devices.id, deviceId) });
+    if (!device) return { success: false, error: 'Device not found' };
+
+    return await db.transaction(async (tx) => {
+      // Revoke existing active label
+      const existing = await tx.query.deviceQrLabels.findFirst({
+        where: and(
+          eq(deviceQrLabels.deviceId, deviceId),
+          eq(deviceQrLabels.labelStatus, 'active'),
+        ),
+      });
+
+      const newRef = generateOpaqueReference();
+
+      if (existing) {
+        await tx.update(deviceQrLabels)
+          .set({
+            labelStatus: 'replaced',
+            revokedAt: new Date(),
+            revokedByUserId: session.id,
+            revocationReason: reason || 'Replaced with new label',
+          })
+          .where(eq(deviceQrLabels.id, existing.id));
+      }
+
+      const [newLabel] = await tx.insert(deviceQrLabels).values({
+        organizationId: device.organizationId,
+        deviceId,
+        opaqueReference: newRef,
+        labelStatus: 'active',
+        createdByUserId: session.id,
+      }).returning();
+
+      if (existing) {
+        await tx.update(deviceQrLabels)
+          .set({ replacedByQrId: newLabel.id })
+          .where(eq(deviceQrLabels.id, existing.id));
+      }
+
+      await createAuditLog(tx, {
+        action: 'CREATE', entityType: 'device_qr_label', entityId: newLabel.id,
+        actorId: session.id,
+        details: { deviceId, opaqueReference: newRef, replacedLabelId: existing?.id, reason },
+      });
+
+      return { success: true, data: newLabel };
+    });
+  } catch (error: any) {
+    return { success: false, error: error.message };
+  }
+}
+
+export async function recordQrPrint(qrLabelId: string) {
+  const session = await requireAuth();
+  try {
+    const [updated] = await db.update(deviceQrLabels)
+      .set({
+        printCount: (await db.query.deviceQrLabels.findFirst({ where: eq(deviceQrLabels.id, qrLabelId) }))!.printCount! + 1,
+        printedAt: new Date(),
+        printedByUserId: session.id,
+      })
+      .where(eq(deviceQrLabels.id, qrLabelId))
+      .returning();
+    return { success: true, data: updated };
+  } catch (error: any) {
+    return { success: false, error: error.message };
+  }
+}
+
+export async function resolveDeviceScan(opaqueReference: string) {
+  try {
+    const qrLabel = await db.query.deviceQrLabels.findFirst({
+      where: eq(deviceQrLabels.opaqueReference, opaqueReference),
+      with: {
+        device: {
+          with: {
+            hospital: true,
+            department: true,
+            location: true,
+          },
+        },
+      },
+    });
+
+    if (!qrLabel) {
+      return { success: false, error: 'QR code not found', code: 'NOT_FOUND' };
+    }
+    if (qrLabel.labelStatus !== 'active') {
+      return { success: false, error: 'This QR label has been revoked or replaced', code: 'INACTIVE' };
+    }
+    if (!qrLabel.device) {
+      return { success: false, error: 'Device not found', code: 'DEVICE_NOT_FOUND' };
+    }
+
+    return {
+      success: true,
+      data: {
+        deviceId: qrLabel.device.id,
+        deviceName: qrLabel.device.name,
+        internalCode: qrLabel.device.internalCode,
+        assetNumber: qrLabel.device.assetNumber,
+        currentStatus: qrLabel.device.currentStatusCode,
+        statusLimitationsNote: qrLabel.device.statusLimitationsNote,
+        organizationId: qrLabel.device.organizationId,
+        hospitalName: qrLabel.device.hospital?.name,
+        departmentName: qrLabel.device.department?.name,
+        locationName: qrLabel.device.location?.name || qrLabel.device.exactLocationDescription,
+      },
+    };
+  } catch (error: any) {
+    return { success: false, error: error.message };
+  }
+}
+

package/src/lib/actions/report-history.ts

@@ -0,0 +1,77 @@
+'use server';
+
+import { db } from '@/lib/db';
+import { generatedReports } from '@/lib/db/schema/report-history';
+import { requireAuth, requirePermission } from '@/lib/auth/rbac';
+import { eq, and, desc } from 'drizzle-orm';
+
+export async function saveReportToHistory(params: {
+  reportType: string;
+  title: string;
+  filters: any;
+  dateRangeStart?: Date;
+  dateRangeEnd?: Date;
+  timezone?: string;
+  rowCount?: number;
+  fileFormat?: string;
+  fileName: string;
+}) {
+  const user = await requireAuth();
+  if (!user.organizationId) {
+    throw new Error('Organization ID required');
+  }
+  
+  const [report] = await db.insert(generatedReports).values({
+    organizationId: user.organizationId,
+    reportType: params.reportType,
+    title: params.title,
+    filtersJsonb: params.filters,
+    dateRangeStart: params.dateRangeStart,
+    dateRangeEnd: params.dateRangeEnd,
+    timezone: params.timezone || 'UTC',
+    rowCount: params.rowCount,
+    fileFormat: params.fileFormat || 'csv',
+    fileName: params.fileName,
+    generatedByUserId: user.id,
+  }).returning();
+  
+  return report;
+}
+
+export async function getReportHistory() {
+  const user = await requireAuth();
+  await requirePermission('REPORTS', 'VIEW');
+  if (!user.organizationId) return [];
+  
+  return db.query.generatedReports.findMany({
+    where: eq(generatedReports.organizationId, user.organizationId),
+    orderBy: [desc(generatedReports.generatedAt)],
+    with: {
+      generatedByUser: {
+        columns: { id: true, fullName: true, email: true }
+      }
+    },
+    limit: 100
+  });
+}
+
+export async function getReportById(id: string) {
+  const user = await requireAuth();
+  await requirePermission('REPORTS', 'VIEW');
+  if (!user.organizationId) return null;
+  
+  const report = await db.query.generatedReports.findFirst({
+    where: and(
+      eq(generatedReports.id, id),
+      eq(generatedReports.organizationId, user.organizationId)
+    ),
+    with: {
+      generatedByUser: {
+        columns: { id: true, fullName: true, email: true }
+      }
+    }
+  });
+  
+  return report;
+}
+

package/src/lib/actions/reports.ts

@@ -0,0 +1,192 @@
+'use server';
+
+import { db } from '@/lib/db';
+import { requireAuth, requirePermission } from '@/lib/auth/rbac';
+import { 
+  devices, serviceTickets, maintenanceTasks, 
+  maintenanceScheduleOccurrences, maintenanceCosts, maintenanceRecords,
+  users, hospitals, departments, deviceCategories
+} from '@/lib/db/schema';
+import { eq, and, sql, gte, lte, desc, inArray, or } from 'drizzle-orm';
+import { z } from 'zod';
+import {
+  inventoryReportFiltersSchema,
+  ticketPerformanceFiltersSchema,
+  maintenanceComplianceFiltersSchema,
+  costReportFiltersSchema,
+  workloadReportFiltersSchema,
+  deviceHistoryFiltersSchema
+} from '@/lib/validators/reports';
+
+export async function getInventoryReport(filters: z.infer<typeof inventoryReportFiltersSchema>) {
+  const user = await requireAuth();
+  await requirePermission('REPORTS', 'VIEW');
+  if (!user.organizationId) return [];
+
+  const conditions: any[] = [eq(devices.organizationId, user.organizationId)];
+  if (filters.hospitalId) conditions.push(eq(devices.hospitalId, filters.hospitalId));
+  if (filters.departmentId) conditions.push(eq(devices.departmentId, filters.departmentId));
+  if (filters.deviceCategoryId) conditions.push(eq(devices.deviceCategoryId, filters.deviceCategoryId));
+  if (filters.status) conditions.push(eq(devices.currentStatusCode, filters.status as any));
+
+  const groupByColumn = (() => {
+    switch(filters.groupBy) {
+      case 'hospital': return devices.hospitalId;
+      case 'department': return devices.departmentId;
+      case 'category': return devices.deviceCategoryId;
+      case 'status': return devices.currentStatusCode;
+      case 'manufacturer': return devices.manufacturerId;
+      default: return devices.departmentId;
+    }
+  })();
+
+  const results = await db.select({
+    groupId: groupByColumn,
+    totalCount: sql<number>`count(*)::int`,
+    operationalCount: sql<number>`sum(case when ${devices.currentStatusCode} = 'operational' then 1 else 0 end)::int`,
+    maintenanceCount: sql<number>`sum(case when ${devices.currentStatusCode} in ('under_maintenance', 'under_repair') then 1 else 0 end)::int`,
+    outOfServiceCount: sql<number>`sum(case when ${devices.currentStatusCode} = 'out_of_service' then 1 else 0 end)::int`,
+    decommissionedCount: sql<number>`sum(case when ${devices.currentStatusCode} = 'decommissioned' then 1 else 0 end)::int`,
+  })
+  .from(devices)
+  .where(and(...conditions))
+  .groupBy(groupByColumn);
+
+  return results;
+}
+
+export async function getTicketPerformanceReport(filters: z.infer<typeof ticketPerformanceFiltersSchema>) {
+  const user = await requireAuth();
+  await requirePermission('REPORTS', 'VIEW');
+  if (!user.organizationId) return null;
+
+  const conditions: any[] = [eq(serviceTickets.organizationId, user.organizationId)];
+  if (filters.hospitalId) conditions.push(eq(serviceTickets.hospitalId, filters.hospitalId));
+  if (filters.departmentId) conditions.push(eq(serviceTickets.departmentId, filters.departmentId));
+  if (filters.startDate) conditions.push(gte(serviceTickets.reportedAt, new Date(filters.startDate)));
+  if (filters.endDate) conditions.push(lte(serviceTickets.reportedAt, new Date(filters.endDate)));
+
+  const results = await db.select({
+    total: sql<number>`count(*)::int`,
+    openCount: sql<number>`sum(case when ${serviceTickets.statusCode} not in ('resolved', 'closed', 'cancelled') then 1 else 0 end)::int`,
+    closedCount: sql<number>`sum(case when ${serviceTickets.statusCode} in ('resolved', 'closed') then 1 else 0 end)::int`,
+    avgResponseTime: sql<number>`coalesce(avg(extract(epoch from (${serviceTickets.acceptedAt} - ${serviceTickets.reportedAt})) / 3600), 0)::float`,
+    avgResolutionTime: sql<number>`coalesce(avg(extract(epoch from (${serviceTickets.resolvedAt} - ${serviceTickets.reportedAt})) / 3600), 0)::float`,
+    priorityP1: sql<number>`sum(case when ${serviceTickets.priorityCode} = 'p1_critical' then 1 else 0 end)::int`,
+    priorityP2: sql<number>`sum(case when ${serviceTickets.priorityCode} = 'p2_high' then 1 else 0 end)::int`,
+    priorityP3: sql<number>`sum(case when ${serviceTickets.priorityCode} = 'p3_normal' then 1 else 0 end)::int`,
+    priorityP4: sql<number>`sum(case when ${serviceTickets.priorityCode} = 'p4_low' then 1 else 0 end)::int`,
+  })
+  .from(serviceTickets)
+  .where(and(...conditions));
+
+  return results[0] || null;
+}
+
+export async function getMaintenanceComplianceReport(filters: z.infer<typeof maintenanceComplianceFiltersSchema>) {
+  const user = await requireAuth();
+  await requirePermission('REPORTS', 'VIEW');
+  if (!user.organizationId) return { totalScheduled: 0, completed: 0, overdue: 0, complianceRate: 0 };
+
+  const conditions: any[] = [
+    eq(maintenanceTasks.organizationId, user.organizationId),
+    eq(maintenanceTasks.maintenanceType, 'preventive_maintenance' as any),
+  ];
+  if (filters.hospitalId) conditions.push(eq(maintenanceTasks.hospitalId, filters.hospitalId));
+  if (filters.departmentId) conditions.push(eq(maintenanceTasks.departmentId, filters.departmentId as any));
+  if (filters.startDate) conditions.push(gte(maintenanceTasks.dueDate, new Date(filters.startDate)));
+  if (filters.endDate) conditions.push(lte(maintenanceTasks.dueDate, new Date(filters.endDate)));
+
+  const results = await db.select({
+    totalScheduled: sql<number>`count(*)::int`,
+    completed: sql<number>`sum(case when ${maintenanceTasks.statusCode} in ('closed', 'work_complete', 'awaiting_review', 'awaiting_release') then 1 else 0 end)::int`,
+    overdue: sql<number>`sum(case when ${maintenanceTasks.statusCode} not in ('closed', 'cancelled') and ${maintenanceTasks.dueDate} < now() then 1 else 0 end)::int`,
+  })
+  .from(maintenanceTasks)
+  .where(and(...conditions));
+
+  const data = results[0] || { totalScheduled: 0, completed: 0, overdue: 0 };
+  const complianceRate = data.totalScheduled > 0
+    ? Math.round((data.completed / data.totalScheduled) * 100)
+    : 0;
+
+  return { ...data, complianceRate };
+}
+
+export async function getCostReport(filters: z.infer<typeof costReportFiltersSchema>) {
+  const user = await requireAuth();
+  await requirePermission('REPORTS', 'VIEW');
+  if (!user.organizationId) return { totalCost: 0, byCostType: [] };
+
+  const conditions: any[] = [eq(maintenanceTasks.organizationId, user.organizationId)];
+  if (filters.hospitalId) conditions.push(eq(maintenanceTasks.hospitalId, filters.hospitalId));
+  if (filters.startDate) conditions.push(gte(maintenanceCosts.recordedAt, new Date(filters.startDate)));
+  if (filters.endDate) conditions.push(lte(maintenanceCosts.recordedAt, new Date(filters.endDate)));
+
+  const results = await db.select({
+    costType: maintenanceCosts.costType,
+    totalAmount: sql<number>`coalesce(sum(${maintenanceCosts.amount}), 0)::int`,
+    count: sql<number>`count(*)::int`,
+  })
+  .from(maintenanceCosts)
+  .innerJoin(maintenanceTasks, eq(maintenanceCosts.maintenanceTaskId, maintenanceTasks.id))
+  .where(and(...conditions))
+  .groupBy(maintenanceCosts.costType);
+
+  const totalCost = results.reduce((acc, r) => acc + (r.totalAmount || 0), 0);
+
+  return { totalCost, byCostType: results };
+}
+
+export async function getWorkloadReport(filters: z.infer<typeof workloadReportFiltersSchema>) {
+  const user = await requireAuth();
+  await requirePermission('REPORTS', 'VIEW');
+  if (!user.organizationId) return [];
+
+  const conditions: any[] = [eq(maintenanceTasks.organizationId, user.organizationId)];
+  if (filters.hospitalId) conditions.push(eq(maintenanceTasks.hospitalId, filters.hospitalId));
+
+  const results = await db.select({
+    engineerId: maintenanceTasks.assignedEngineerUserId,
+    assignedCount: sql<number>`count(*)::int`,
+    completedCount: sql<number>`sum(case when ${maintenanceTasks.statusCode} in ('closed', 'work_complete', 'awaiting_review', 'awaiting_release') then 1 else 0 end)::int`,
+    inProgressCount: sql<number>`sum(case when ${maintenanceTasks.statusCode} in ('assigned', 'in_progress') then 1 else 0 end)::int`,
+    priorityP1Count: sql<number>`sum(case when ${maintenanceTasks.priorityCode} = 'p1_critical' then 1 else 0 end)::int`,
+    pmCount: sql<number>`sum(case when ${maintenanceTasks.maintenanceType} = 'preventive_maintenance' then 1 else 0 end)::int`,
+  })
+  .from(maintenanceTasks)
+  .where(and(...conditions, sql`${maintenanceTasks.assignedEngineerUserId} IS NOT NULL`))
+  .groupBy(maintenanceTasks.assignedEngineerUserId);
+
+  return results;
+}
+
+export async function getDeviceHistoryReport(filters: z.infer<typeof deviceHistoryFiltersSchema>) {
+  const user = await requireAuth();
+  await requirePermission('REPORTS', 'VIEW');
+  if (!user.organizationId) return { tickets: [], tasks: [] };
+
+  if (!filters.deviceId) {
+    throw new Error('Device ID is required for device history report');
+  }
+
+  const [tickets, tasks] = await Promise.all([
+    db.query.serviceTickets.findMany({
+      where: and(
+        eq(serviceTickets.deviceId, filters.deviceId),
+        eq(serviceTickets.organizationId, user.organizationId),
+      ),
+      orderBy: [desc(serviceTickets.reportedAt)],
+    }),
+    db.query.maintenanceTasks.findMany({
+      where: and(
+        eq(maintenanceTasks.deviceId, filters.deviceId),
+        eq(maintenanceTasks.organizationId, user.organizationId),
+      ),
+      orderBy: [desc(maintenanceTasks.createdAt)],
+    }),
+  ]);
+
+  return { tickets, tasks };
+}
+

package/src/lib/actions/roles.ts

@@ -0,0 +1,32 @@
+'use server';
+
+import { db } from '@/lib/db';
+import { requireAuth, requireRole } from '@/lib/auth/rbac';
+
+export async function getRoles() {
+  await requireAuth();
+  await requireRole('SYS_ADMIN', 'ORG_ADMIN');
+  try {
+    const data = await db.query.roles.findMany();
+    return { success: true, data };
+  } catch (error: any) {
+    return { success: false, error: error.message };
+  }
+}
+
+export async function getPermissionsMatrix() {
+  await requireAuth();
+  await requireRole('SYS_ADMIN', 'ORG_ADMIN');
+  try {
+    const data = await db.query.rolePermissions.findMany({
+      with: {
+        role: true,
+        permission: true,
+      }
+    });
+    return { success: true, data };
+  } catch (error: any) {
+    return { success: false, error: error.message };
+  }
+}
+