| 1 | import { createAccessControl } from "better-auth/plugins/access"; |
| 2 | |
| 3 | /** Repository roles, lowest to highest. Each includes everything below it, the way GitHub's do; `owner` is held only by a repository's owner. */ |
| 4 | export const roleHierarchy = |
| 5 | "read", |
| 6 | "triage", |
| 7 | "write", |
| 8 | "maintain", |
| 9 | "admin", |
| 10 | "owner", |
| 11 | ] as const; |
| 12 | |
| 13 | export type Role |
| 14 | |
| 15 | /** Whether `role` includes everything `needed` may do. */ |
| 16 | export function atLeast(role |
| 17 | return ( |
| 18 | role != null && |
| 19 | ); |
| 20 | } |
| 21 | |
| 22 | /** What Better Auth's organization plugin checks: managing the organization itself, never a repository. */ |
| 23 | export const statement = |
| 24 | organization: ["update", |
| 25 | member: ["create", |
| 26 | invitation: ["create", |
| 27 | team: ["create", |
| 28 | ac: ["create", |
| 29 | } as const; |
| 30 | |
| 31 | export const ac = |
| 32 | |
| 33 | /** Organization roles, lowest to highest. Admins administer and owners own every repository of the organization; members get its base permission (docs/0023). */ |
| 34 | export const organizationRoleHierarchy = |
| 35 | |
| 36 | export type OrganizationRole |
| 37 | |
| 38 | /** Admins and owners run the organization: its settings, people, teams and every repository. */ |
| 39 | export function administers(role |
| 40 | return role === |
| 41 | } |
| 42 | |
| 43 | /** The highest organization role in a Better Auth `member.role`, which may hold several joined by commas. Custom roles count for nothing. */ |
| 44 | export function organizationRoleOf( |
| 45 | memberRole: string |
| 46 | ): OrganizationRole | |
| 47 | const held = |
| 48 | .map((role) |
| 49 | organizationRoleHierarchy.indexOf(role |
| 50 | ) |
| 51 | .filter((index) |
| 52 | return held.length |
| 53 | } |
| 54 | |
| 55 | const member = ac |
| 56 | organization: [], |
| 57 | member: [], |
| 58 | invitation: [], |
| 59 | team: [], |
| 60 | ac: ["read"], |
| 61 | }); |
| 62 | |
| 63 | const admin = ac |
| 64 | organization: ["update"], |
| 65 | member: ["create", |
| 66 | invitation: ["create", |
| 67 | team: ["create", |
| 68 | ac: ["read"], |
| 69 | }); |
| 70 | |
| 71 | const owner = ac |
| 72 | organization: ["update", |
| 73 | member: ["create", |
| 74 | invitation: ["create", |
| 75 | team: ["create", |
| 76 | ac: ["create", |
| 77 | }); |
| 78 | |
| 79 | /** The roles Better Auth's organization plugin knows. */ |
| 80 | export const roles = |