rbac-api-example.ts

export const OrgResource = RBAC.defineResource({
  name: dev`Organization`,
  idSchema: OrgID,
  permissions: {
    CreateWorkspace: (its) => its.Member,
  },
  roles: {
    Admin: true,
    Member: true,
    Guest: true,
  },
  rolesImply: {
    Admin: { Member: true },
    Member: { Guest: true },
    Guest: {},
  },
  related: {},
});

export const WorkspaceResource = RBAC.defineResource({
  name: dev`Workspace`,
  idSchema: WorkspaceID,
  permissions: {
    CreateProposal: (its, { org }) => its.Suggestor || its.GuestSuggestor || org.Admin,
    MergeProposal: (its, { org }) => its.Editor || its.GuestEditor || org.Admin,
  },
  related: { org: OrgResource },
  roles: {
    Manager: true,
    Editor: true,
    Suggestor: true,
    GuestEditor: true,
    GuestSuggestor: true,
    GuestViewer: true,
  },
  rolesImply: {
    Manager: { Editor: true },
    Editor: { Suggestor: true },
    Suggestor: {},
    GuestEditor: { GuestSuggestor: true },
    GuestSuggestor: { GuestViewer: true },
    GuestViewer: {},
  },
});
export const WorkspaceProposalResource = RBAC.defineResource({
  name: dev`Proposal`,
  idSchema: WorkspaceProposalID,
  permissions: {
    Archive: (its, { workspace }) => its.Owner || workspace.Manager,
    Close: (its, { workspace }) => its.Owner || workspace.Manager,
    Update: (its, { workspace }) => its.Owner || workspace.Manager,
    Comment: (its, { workspace }) => its.Owner || workspace.Suggestor,
    AssignToPersonInYourOrg: (its, { workspace }) => its.Owner || workspace.Manager,
    AssignToPersonInOtherOrg: (its, { workspace }) => its.Owner || workspace.Manager,
    View: (its, { workspace }) => its.Owner || workspace.GuestViewer,
  },
  related: {
    workspace: WorkspaceResource,
  },
  roles: {
    Owner: true,
    Assignee: true,
  },
  rolesImply: {},
});

export const UserProfileResource = RBAC.defineResource({
  name: dev`UserProfile`,
  idSchema: OrgUserID,
  permissions: {
    Update: (its, { org }) => org.Admin || (org.Guest && its.Self),
    View: (its, { org }) => org.Member || its.Self,
  },
  related: { org: OrgResource },
  roles: { Self: true },
  rolesImply: {},
});