vperms-testing 1.0.0

package/server/routes/roles.js

@@ -0,0 +1,208 @@
+import { Hono } from 'hono';
+import { authMiddleware, requirePermission } from '../middleware/auth.js';
+
+const router = new Hono();
+
+// All routes require authentication
+router.use('*', authMiddleware);
+
+/**
+ * GET /api/roles
+ * List all roles
+ */
+router.get('/', requirePermission('roles.list'), async (c) => {
+    const perms = c.get('perms');
+
+    try {
+        const roles = await perms.manager.listRoles();
+        return c.json({ roles });
+    } catch (error) {
+        console.error('List roles error:', error);
+        return c.json({ error: 'Failed to list roles' }, 500);
+    }
+});
+
+/**
+ * POST /api/roles
+ * Create a new role
+ */
+router.post('/', requirePermission('roles.create'), async (c) => {
+    const perms = c.get('perms');
+
+    try {
+        const { name, description, priority = 0, isDefault = false } = await c.req.json();
+
+        if (!name) {
+            return c.json({ error: 'Role name required' }, 400);
+        }
+
+        const role = await perms.createRole(name, description, priority, isDefault);
+        return c.json({ message: 'Role created', role });
+    } catch (error) {
+        console.error('Create role error:', error);
+        return c.json({ error: error.message || 'Failed to create role' }, 500);
+    }
+});
+
+/**
+ * GET /api/roles/:id
+ * Get a specific role with permissions
+ */
+router.get('/:id', requirePermission('roles.view'), async (c) => {
+    const perms = c.get('perms');
+    const roleId = c.req.param('id');
+
+    try {
+        const role = await perms.manager.getRole(roleId);
+
+        if (!role) {
+            return c.json({ error: 'Role not found' }, 404);
+        }
+
+        const permissions = await perms.manager.getRolePermissions(roleId);
+        const inheritance = await perms.manager.getRoleInheritance(roleId);
+
+        return c.json({
+            role,
+            permissions,
+            inheritsFrom: inheritance.map(i => ({
+                id: i.inheritsFromId,
+                name: i.inheritsFrom.name,
+                priority: i.priority,
+            })),
+        });
+    } catch (error) {
+        console.error('Get role error:', error);
+        return c.json({ error: 'Failed to get role' }, 500);
+    }
+});
+
+/**
+ * PUT /api/roles/:id
+ * Update a role
+ */
+router.put('/:id', requirePermission('roles.update'), async (c) => {
+    const perms = c.get('perms');
+    const roleId = c.req.param('id');
+
+    try {
+        const { description, priority, isDefault } = await c.req.json();
+
+        const data = {};
+        if (description !== undefined) data.description = description;
+        if (priority !== undefined) data.priority = priority;
+        if (isDefault !== undefined) data.isDefault = isDefault;
+
+        const role = await perms.manager.updateRole(roleId, data);
+        return c.json({ message: 'Role updated', role });
+    } catch (error) {
+        console.error('Update role error:', error);
+        return c.json({ error: error.message || 'Failed to update role' }, 500);
+    }
+});
+
+/**
+ * DELETE /api/roles/:id
+ * Delete a role
+ */
+router.delete('/:id', requirePermission('roles.delete'), async (c) => {
+    const perms = c.get('perms');
+    const roleId = c.req.param('id');
+
+    try {
+        await perms.deleteRole(roleId);
+        return c.json({ message: 'Role deleted' });
+    } catch (error) {
+        console.error('Delete role error:', error);
+        return c.json({ error: error.message || 'Failed to delete role' }, 500);
+    }
+});
+
+/**
+ * POST /api/roles/:id/permissions
+ * Assign permission to role
+ */
+router.post('/:id/permissions', requirePermission('roles.assign-permission'), async (c) => {
+    const perms = c.get('perms');
+    const roleId = c.req.param('id');
+
+    try {
+        const { permissionKey, granted = true } = await c.req.json();
+
+        if (!permissionKey) {
+            return c.json({ error: 'Permission key required' }, 400);
+        }
+
+        if (granted) {
+            await perms.assignPermission(permissionKey, roleId, 'role');
+        } else {
+            await perms.banPermission(permissionKey, roleId, 'role');
+        }
+
+        return c.json({ message: 'Permission assigned to role' });
+    } catch (error) {
+        console.error('Assign permission error:', error);
+        return c.json({ error: error.message || 'Failed to assign permission' }, 500);
+    }
+});
+
+/**
+ * DELETE /api/roles/:id/permissions/:key
+ * Remove permission from role
+ */
+router.delete('/:id/permissions/:key', requirePermission('roles.remove-permission'), async (c) => {
+    const perms = c.get('perms');
+    const roleId = c.req.param('id');
+    const permissionKey = c.req.param('key');
+
+    try {
+        await perms.removePermission(permissionKey, roleId, 'role');
+        return c.json({ message: 'Permission removed from role' });
+    } catch (error) {
+        console.error('Remove permission error:', error);
+        return c.json({ error: error.message || 'Failed to remove permission' }, 500);
+    }
+});
+
+/**
+ * POST /api/roles/:id/inheritance
+ * Set role inheritance
+ */
+router.post('/:id/inheritance', requirePermission('roles.set-inheritance'), async (c) => {
+    const perms = c.get('perms');
+    const roleId = c.req.param('id');
+
+    try {
+        const { inheritsFromId, priority = 0 } = await c.req.json();
+
+        if (!inheritsFromId) {
+            return c.json({ error: 'inheritsFromId required' }, 400);
+        }
+
+        await perms.manager.setRoleInheritance(roleId, inheritsFromId, priority);
+        return c.json({ message: 'Inheritance set' });
+    } catch (error) {
+        console.error('Set inheritance error:', error);
+        return c.json({ error: error.message || 'Failed to set inheritance' }, 500);
+    }
+});
+
+/**
+ * DELETE /api/roles/:id/inheritance/:inheritsFromId
+ * Remove role inheritance
+ */
+router.delete('/:id/inheritance/:inheritsFromId', requirePermission('roles.remove-inheritance'), async (c) => {
+    const perms = c.get('perms');
+    const roleId = c.req.param('id');
+    const inheritsFromId = c.req.param('inheritsFromId');
+
+    try {
+        await perms.manager.removeRoleInheritance(roleId, inheritsFromId);
+        return c.json({ message: 'Inheritance removed' });
+    } catch (error) {
+        console.error('Remove inheritance error:', error);
+        return c.json({ error: error.message || 'Failed to remove inheritance' }, 500);
+    }
+});
+
+export default router;

package/server/routes/users.js

@@ -0,0 +1,191 @@
+import { Hono } from 'hono';
+import { authMiddleware, requirePermission } from '../middleware/auth.js';
+
+const router = new Hono();
+
+// All routes require authentication
+router.use('*', authMiddleware);
+
+/**
+ * GET /api/users
+ * List all users (requires permission)
+ */
+router.get('/', requirePermission('users.list'), async (c) => {
+    const prisma = c.get('prisma');
+
+    try {
+        const users = await prisma.user.findMany({
+            select: {
+                id: true,
+                email: true,
+                name: true,
+                createdAt: true,
+                userRoles: {
+                    include: { role: true },
+                },
+            },
+            orderBy: { createdAt: 'desc' },
+        });
+
+        return c.json({
+            users: users.map(u => ({
+                id: u.id,
+                email: u.email,
+                name: u.name,
+                createdAt: u.createdAt,
+                roles: u.userRoles.map(ur => ur.role.name),
+            })),
+        });
+    } catch (error) {
+        console.error('List users error:', error);
+        return c.json({ error: 'Failed to list users' }, 500);
+    }
+});
+
+/**
+ * GET /api/users/:id
+ * Get a specific user
+ */
+router.get('/:id', requirePermission('users.view'), async (c) => {
+    const prisma = c.get('prisma');
+    const perms = c.get('perms');
+    const userId = c.req.param('id');
+
+    try {
+        const user = await prisma.user.findUnique({
+            where: { id: userId },
+            select: {
+                id: true,
+                email: true,
+                name: true,
+                createdAt: true,
+            },
+        });
+
+        if (!user) {
+            return c.json({ error: 'User not found' }, 404);
+        }
+
+        const roles = await perms.manager.getUserRoles(userId);
+        const permissions = await perms.manager.getUserPermissions(userId);
+
+        return c.json({
+            user,
+            roles,
+            permissions,
+        });
+    } catch (error) {
+        console.error('Get user error:', error);
+        return c.json({ error: 'Failed to get user' }, 500);
+    }
+});
+
+/**
+ * DELETE /api/users/:id
+ * Delete a user
+ */
+router.delete('/:id', requirePermission('users.delete'), async (c) => {
+    const prisma = c.get('prisma');
+    const userId = c.req.param('id');
+
+    try {
+        await prisma.user.delete({
+            where: { id: userId },
+        });
+
+        return c.json({ message: 'User deleted' });
+    } catch (error) {
+        console.error('Delete user error:', error);
+        return c.json({ error: 'Failed to delete user' }, 500);
+    }
+});
+
+/**
+ * POST /api/users/:id/roles
+ * Assign role to user
+ */
+router.post('/:id/roles', requirePermission('users.assign-role'), async (c) => {
+    const perms = c.get('perms');
+    const userId = c.req.param('id');
+
+    try {
+        const { roleId } = await c.req.json();
+
+        if (!roleId) {
+            return c.json({ error: 'Role ID required' }, 400);
+        }
+
+        await perms.assignRole(roleId, userId);
+
+        return c.json({ message: 'Role assigned' });
+    } catch (error) {
+        console.error('Assign role error:', error);
+        return c.json({ error: error.message || 'Failed to assign role' }, 500);
+    }
+});
+
+/**
+ * DELETE /api/users/:id/roles/:roleId
+ * Remove role from user
+ */
+router.delete('/:id/roles/:roleId', requirePermission('users.remove-role'), async (c) => {
+    const perms = c.get('perms');
+    const userId = c.req.param('id');
+    const roleId = c.req.param('roleId');
+
+    try {
+        await perms.removeRole(roleId, userId);
+        return c.json({ message: 'Role removed' });
+    } catch (error) {
+        console.error('Remove role error:', error);
+        return c.json({ error: error.message || 'Failed to remove role' }, 500);
+    }
+});
+
+/**
+ * POST /api/users/:id/permissions
+ * Assign direct permission to user
+ */
+router.post('/:id/permissions', requirePermission('users.assign-permission'), async (c) => {
+    const perms = c.get('perms');
+    const userId = c.req.param('id');
+
+    try {
+        const { permissionKey, granted = true } = await c.req.json();
+
+        if (!permissionKey) {
+            return c.json({ error: 'Permission key required' }, 400);
+        }
+
+        if (granted) {
+            await perms.assignPermission(permissionKey, userId, 'user');
+        } else {
+            await perms.banPermission(permissionKey, userId, 'user');
+        }
+
+        return c.json({ message: 'Permission assigned' });
+    } catch (error) {
+        console.error('Assign permission error:', error);
+        return c.json({ error: error.message || 'Failed to assign permission' }, 500);
+    }
+});
+
+/**
+ * GET /api/users/:id/check/:permission
+ * Check if user has a specific permission
+ */
+router.get('/:id/check/:permission', requirePermission('users.check-permission'), async (c) => {
+    const perms = c.get('perms');
+    const userId = c.req.param('id');
+    const permission = c.req.param('permission');
+
+    try {
+        const hasPermission = await perms.can(userId, permission);
+        return c.json({ userId, permission, hasPermission });
+    } catch (error) {
+        console.error('Check permission error:', error);
+        return c.json({ error: 'Failed to check permission' }, 500);
+    }
+});
+
+export default router;

package/server/seed.js

@@ -0,0 +1,167 @@
+import { PrismaClient } from '@prisma/client';
+import { createPermissionSystem } from '@faryzal2020/v-perms';
+import bcrypt from 'bcryptjs';
+
+const prisma = new PrismaClient();
+const perms = createPermissionSystem(prisma, { debug: true });
+
+async function main() {
+    console.log('🌱 Starting seed...\n');
+
+    // Create permissions
+    const permissions = [
+        // User permissions
+        { key: 'users.list', description: 'List all users', category: 'users' },
+        { key: 'users.view', description: 'View user details', category: 'users' },
+        { key: 'users.delete', description: 'Delete users', category: 'users' },
+        { key: 'users.assign-role', description: 'Assign roles to users', category: 'users' },
+        { key: 'users.remove-role', description: 'Remove roles from users', category: 'users' },
+        { key: 'users.assign-permission', description: 'Assign permissions to users', category: 'users' },
+        { key: 'users.check-permission', description: 'Check user permissions', category: 'users' },
+
+        // Role permissions
+        { key: 'roles.list', description: 'List all roles', category: 'roles' },
+        { key: 'roles.view', description: 'View role details', category: 'roles' },
+        { key: 'roles.create', description: 'Create roles', category: 'roles' },
+        { key: 'roles.update', description: 'Update roles', category: 'roles' },
+        { key: 'roles.delete', description: 'Delete roles', category: 'roles' },
+        { key: 'roles.assign-permission', description: 'Assign permissions to roles', category: 'roles' },
+        { key: 'roles.remove-permission', description: 'Remove permissions from roles', category: 'roles' },
+        { key: 'roles.set-inheritance', description: 'Set role inheritance', category: 'roles' },
+        { key: 'roles.remove-inheritance', description: 'Remove role inheritance', category: 'roles' },
+
+        // Permission permissions
+        { key: 'permissions.list', description: 'List all permissions', category: 'permissions' },
+        { key: 'permissions.create', description: 'Create permissions', category: 'permissions' },
+        { key: 'permissions.delete', description: 'Delete permissions', category: 'permissions' },
+    ];
+
+    console.log('📝 Creating permissions...');
+    for (const perm of permissions) {
+        try {
+            await perms.createPermission(perm.key, perm.description, perm.category);
+            console.log(`  ✓ ${perm.key}`);
+        } catch (error) {
+            console.log(`  - ${perm.key} (already exists)`);
+        }
+    }
+
+    // Create roles
+    console.log('\n👥 Creating roles...');
+
+    // Member role (basic user)
+    let memberRole;
+    try {
+        memberRole = await perms.createRole('member', 'Basic member with limited access', 1, true);
+        console.log('  ✓ member (default role)');
+    } catch (error) {
+        memberRole = await perms.manager.getRole('member');
+        console.log('  - member (already exists)');
+    }
+
+    // Moderator role
+    let moderatorRole;
+    try {
+        moderatorRole = await perms.createRole('moderator', 'Moderator with user management', 5, false);
+        console.log('  ✓ moderator');
+    } catch (error) {
+        moderatorRole = await perms.manager.getRole('moderator');
+        console.log('  - moderator (already exists)');
+    }
+
+    // Admin role
+    let adminRole;
+    try {
+        adminRole = await perms.createRole('admin', 'Administrator with full access', 10, false);
+        console.log('  ✓ admin');
+    } catch (error) {
+        adminRole = await perms.manager.getRole('admin');
+        console.log('  - admin (already exists)');
+    }
+
+    // Assign permissions to roles
+    console.log('\n🔐 Assigning permissions to roles...');
+
+    // Member gets basic permissions
+    await perms.assignPermission('users.view', memberRole.id, 'role');
+    await perms.assignPermission('roles.list', memberRole.id, 'role');
+    console.log('  ✓ member: users.view, roles.list');
+
+    // Moderator inherits from member + gets more
+    try {
+        await perms.manager.setRoleInheritance(moderatorRole.id, memberRole.id);
+    } catch (e) { }
+    await perms.assignPermission('users.list', moderatorRole.id, 'role');
+    await perms.assignPermission('roles.view', moderatorRole.id, 'role');
+    console.log('  ✓ moderator: inherits member + users.list, roles.view');
+
+    // Admin gets all permissions via wildcard
+    try {
+        await perms.manager.setRoleInheritance(adminRole.id, moderatorRole.id);
+    } catch (e) { }
+    await perms.assignPermission('*', adminRole.id, 'role');
+    console.log('  ✓ admin: inherits moderator + * (all permissions)');
+
+    // Create test users
+    console.log('\n👤 Creating test users...');
+
+    const hashedPassword = await bcrypt.hash('password123', 10);
+
+    // Regular user
+    let regularUser;
+    try {
+        regularUser = await prisma.user.create({
+            data: {
+                email: 'user@example.com',
+                password: hashedPassword,
+                name: 'Regular User',
+            },
+        });
+        await perms.assignRole(memberRole.id, regularUser.id);
+        console.log('  ✓ user@example.com (member)');
+    } catch (error) {
+        console.log('  - user@example.com (already exists)');
+    }
+
+    // Moderator user
+    let modUser;
+    try {
+        modUser = await prisma.user.create({
+            data: {
+                email: 'mod@example.com',
+                password: hashedPassword,
+                name: 'Moderator User',
+            },
+        });
+        await perms.assignRole(moderatorRole.id, modUser.id);
+        console.log('  ✓ mod@example.com (moderator)');
+    } catch (error) {
+        console.log('  - mod@example.com (already exists)');
+    }
+
+    // Admin user
+    let adminUser;
+    try {
+        adminUser = await prisma.user.create({
+            data: {
+                email: 'admin@example.com',
+                password: hashedPassword,
+                name: 'Admin User',
+            },
+        });
+        await perms.assignRole(adminRole.id, adminUser.id);
+        console.log('  ✓ admin@example.com (admin)');
+    } catch (error) {
+        console.log('  - admin@example.com (already exists)');
+    }
+
+    console.log('\n✅ Seed complete!\n');
+    console.log('Test accounts (password: password123):');
+    console.log('  - user@example.com (member)');
+    console.log('  - mod@example.com (moderator)');
+    console.log('  - admin@example.com (admin)');
+}
+
+main()
+    .catch(console.error)
+    .finally(() => prisma.$disconnect());