36 lines
1.4 KiB
Python
36 lines
1.4 KiB
Python
from __future__ import annotations
|
|
|
|
from app.domain.auth import PermissionContext
|
|
|
|
|
|
def build_permission_context(
|
|
role_name: str | None,
|
|
domain_permissions: list[str],
|
|
) -> PermissionContext:
|
|
"""Translate Directus role/group permissions into product capabilities.
|
|
|
|
We keep the first version intentionally explicit instead of clever:
|
|
reviewers can see exactly which strings unlock which capabilities.
|
|
"""
|
|
|
|
normalized = {permission.strip().lower() for permission in domain_permissions if permission}
|
|
role_normalized = (role_name or "").strip().lower()
|
|
is_admin = role_normalized in {"administrator", "admin"}
|
|
|
|
def has_any(*values: str) -> bool:
|
|
return is_admin or any(value in normalized for value in values)
|
|
|
|
return PermissionContext(
|
|
is_admin=is_admin,
|
|
can_manage_sites=has_any("sites.manage", "sites.write"),
|
|
can_manage_experiments=has_any("experiments.manage", "experiments.write"),
|
|
can_manage_variants=has_any("variants.manage", "variants.write"),
|
|
can_manage_releases=has_any("releases.manage", "releases.write"),
|
|
can_manage_goals=has_any("goals.manage", "goals.write"),
|
|
can_manage_sdk_configs=has_any("sdk_configs.manage", "sdk_configs.write"),
|
|
can_use_editor=has_any("editor.manage", "editor.use"),
|
|
can_read_runtime=has_any("runtime.read", "runtime.manage"),
|
|
raw_permissions=sorted(normalized),
|
|
)
|
|
|