54 lines
3.4 KiB
TypeScript
54 lines
3.4 KiB
TypeScript
import type { UserRole } from '../../auth.js';
|
|
|
|
export type RoutePermission = 'public' | 'machine' | 'authenticated' | 'viewer' | 'operator' | 'admin';
|
|
|
|
const within = (route: string, base: string): boolean => route === base || route.startsWith(base + '/');
|
|
const readMethod = (method: string): boolean => method === 'GET' || method === 'HEAD';
|
|
|
|
/** Classify SvelteKit's resolved route ID, never a user-supplied URL pathname.
|
|
* Route IDs preserve the same policy for page-data requests and encoded URLs.
|
|
* Machine endpoints enforce their own host/enrollment/telemetry credentials.
|
|
*/
|
|
export function routePermission(routeId: string | null, method: string): RoutePermission {
|
|
method = method.toUpperCase();
|
|
const reading = readMethod(method);
|
|
if (routeId === null) return reading ? 'viewer' : 'operator';
|
|
// These cannot occur in this application's resolved route IDs. Fail closed
|
|
// if a future caller accidentally supplies a raw or noncanonical pathname.
|
|
if (!routeId.startsWith('/') || /[%\\?#\x00-\x1f\x7f]/.test(routeId)
|
|
|| routeId !== '/' && routeId.split('/').slice(1).some(part => !part || part === '.' || part === '..')) return 'admin';
|
|
|
|
if (within(routeId, '/api/agent')) return 'machine';
|
|
if (routeId === '/api/telemetry' && method === 'POST') return 'machine';
|
|
if (routeId === '/api/leaderboard' && reading) return 'public';
|
|
if ((routeId === '/login' || routeId === '/setup') && reading) return 'public';
|
|
if ((routeId === '/api/auth/login' || routeId === '/api/auth/setup') && method === 'POST') return 'public';
|
|
if (routeId === '/account' || ['/api/auth/me', '/api/auth/logout', '/api/auth/password'].includes(routeId)) return 'authenticated';
|
|
|
|
if (within(routeId, '/api/users') || within(routeId, '/settings') || within(routeId, '/api/auth')
|
|
|| within(routeId, '/api/server-keys') || within(routeId, '/server-keys') || within(routeId, '/keys')) return 'admin';
|
|
|
|
if (!reading && ['/api/hosts', '/api/settings', '/api/game-files'].some(base => within(routeId, base))) return 'admin';
|
|
if (routeId === '/api/provisioning/[id]/override') return 'admin';
|
|
// These endpoints mix operational actions with global policy and schedule
|
|
// changes. Per-incident/job actions remain available to operators.
|
|
if (!reading && ['/api/maintenance', '/api/plutonium', '/api/watchdog'].includes(routeId)) return 'admin';
|
|
|
|
// Summaries remain visible to viewers; raw configuration, historical file
|
|
// bytes, and unfiltered diagnostics may contain runtime credentials.
|
|
if (routeId === '/configs/[id]' || routeId === '/api/configs/[id]' || routeId === '/api/configs/inspect'
|
|
|| routeId === '/api/campaigns/[id]/file/[fileId]' || routeId === '/api/deployments/[id]/file/[fileId]'
|
|
|| routeId === '/api/servers/[name]/logs/[file]' || routeId === '/api/servers/[name]/telemetry-requests') return 'operator';
|
|
|
|
return reading ? 'viewer' : 'operator';
|
|
}
|
|
|
|
/** A browser role never substitutes for a machine credential. */
|
|
export function roleAllows(role: UserRole, permission: RoutePermission): boolean {
|
|
if (!['viewer', 'operator', 'admin'].includes(role)) return false;
|
|
if (permission === 'machine') return false;
|
|
if (permission === 'public' || permission === 'authenticated' || permission === 'viewer') return true;
|
|
if (permission === 'operator') return role === 'operator' || role === 'admin';
|
|
return permission === 'admin' && role === 'admin';
|
|
}
|