| 1 | import { createAccessControl } from 'better-auth/plugins/access'; |
| 2 | |
| 3 | export const statement = |
| 4 | organization: ['read', |
| 5 | member: ['read', |
| 6 | invitation: ['create', |
| 7 | team: ['read', |
| 8 | ac: ['create', |
| 9 | repository: [ |
| 10 | 'read', |
| 11 | 'create', |
| 12 | 'push', |
| 13 | 'merge', |
| 14 | 'manage', |
| 15 | 'rename', |
| 16 | 'archive', |
| 17 | 'delete', |
| 18 | 'transfer', |
| 19 | 'manageAccess', |
| 20 | 'manageSecurity', |
| 21 | ], |
| 22 | issue: ['read', |
| 23 | } as const; |
| 24 | |
| 25 | export const ac = |
| 26 | |
| 27 | /** Each rung inherits the one below it, the way GitHub's roles do. */ |
| 28 | |
| 29 | /** Read: clone, open issues and pull requests, comment. */ |
| 30 | const readStatements = { |
| 31 | organization: ['read'], |
| 32 | member: ['read'], |
| 33 | invitation: [], |
| 34 | team: ['read'], |
| 35 | ac: ['read'], |
| 36 | repository: ['read'], |
| 37 | issue: ['read', |
| 38 | } as const; |
| 39 | |
| 40 | /** Triage: read, plus managing other people's issues without write access. */ |
| 41 | const triageStatements = { |
| 42 | ...readStatements, |
| 43 | issue: [...readStatements |
| 44 | } as const; |
| 45 | |
| 46 | /** Write: triage, plus pushing and merging. */ |
| 47 | const writeStatements = { |
| 48 | ...triageStatements, |
| 49 | repository: [...triageStatements |
| 50 | } as const; |
| 51 | |
| 52 | /** Maintain: write, plus repository upkeep short of destructive settings. */ |
| 53 | const maintainStatements = { |
| 54 | ...writeStatements, |
| 55 | team: [...writeStatements |
| 56 | repository: [...writeStatements |
| 57 | } as const; |
| 58 | |
| 59 | /** Admin: maintain, plus access control and destructive repository actions. */ |
| 60 | const adminStatements = { |
| 61 | ...maintainStatements, |
| 62 | organization: [...maintainStatements |
| 63 | member: [...maintainStatements |
| 64 | invitation: ['create', |
| 65 | team: [...maintainStatements |
| 66 | ac: [...maintainStatements |
| 67 | repository: [ |
| 68 | ...maintainStatements.repository |
| 69 | 'create', |
| 70 | 'archive', |
| 71 | 'delete', |
| 72 | 'manageAccess', |
| 73 | 'manageSecurity', |
| 74 | ], |
| 75 | issue: [...maintainStatements |
| 76 | } as const; |
| 77 | |
| 78 | /** Owner: admin, plus the actions that end the organization or move it. */ |
| 79 | const ownerStatements = { |
| 80 | ...adminStatements, |
| 81 | organization: [ |
| 82 | ...adminStatements.organization |
| 83 | 'delete', |
| 84 | 'transfer', |
| 85 | 'billing', |
| 86 | ], |
| 87 | repository: [...adminStatements |
| 88 | } as const; |
| 89 | |
| 90 | export const read = |
| 91 | export const triage = |
| 92 | export const write = |
| 93 | export const maintain = |
| 94 | export const admin = |
| 95 | export const owner = |
| 96 | |
| 97 | export const roles = |
| 98 | |
| 99 | export type Role |
| 100 | |
| 101 | /** Lowest to highest, for comparisons and for rendering pickers in order. */ |
| 102 | export const roleHierarchy = |
| 103 | 'read', |
| 104 | 'triage', |
| 105 | 'write', |
| 106 | 'maintain', |
| 107 | 'admin', |
| 108 | 'owner', |
| 109 | ] as const satisfies |