Add team roles and content management updates

2026-06-25 19:52:46 +02:00
parent 54293f4c45
commit 693769e5a8
126 changed files with 6966 additions and 738 deletions
@@ -0,0 +1,126 @@
+using System.Text.Json;
+using Backend.Data;
+using Microsoft.EntityFrameworkCore;
+
+namespace Backend.Security;
+
+public static class AdminPermissionCatalog
+{
+    public const string Dashboard = "dashboard";
+    public const string Years = "years";
+    public const string Nominations = "nominations";
+    public const string Categories = "categories";
+    public const string Candidates = "candidates";
+    public const string Clips = "clips";
+    public const string Risk = "risk";
+    public const string Audit = "audit";
+    public const string Analytics = "analytics";
+    public const string Winners = "winners";
+    public const string Content = "content";
+    public const string Settings = "settings";
+    public const string Team = "team";
+
+    public static readonly string[] AllPermissionKeys =
+    [
+        Dashboard,
+        Years,
+        Nominations,
+        Categories,
+        Candidates,
+        Clips,
+        Risk,
+        Audit,
+        Analytics,
+        Winners,
+        Content,
+        Settings,
+        Team,
+    ];
+
+    public static readonly string[] SeasonReadPermissionKeys =
+    [
+        Dashboard,
+        Years,
+        Nominations,
+        Categories,
+        Candidates,
+        Clips,
+        Analytics,
+        Winners,
+    ];
+
+    public static bool IsKnownPermission(string permissionKey) =>
+        AllPermissionKeys.Contains(permissionKey, StringComparer.OrdinalIgnoreCase);
+
+    public static string[] DefaultPermissionKeys(string? role)
+    {
+        return AdminRoles.Normalize(role) switch
+        {
+            AdminRoles.Owner => AllPermissionKeys,
+            AdminRoles.Creator => AllPermissionKeys,
+            AdminRoles.Admin => AllPermissionKeys.Where(key => key is not Settings).ToArray(),
+            AdminRoles.Member => [Dashboard, Nominations, Categories, Candidates, Clips, Content],
+            AdminRoles.Reviewer => [Dashboard, Nominations, Clips, Risk, Audit],
+            AdminRoles.OrganizationTeam => [Dashboard, Content, Analytics, Winners, Settings],
+            AdminRoles.ContentAdmin => [Content, Settings],
+            _ => [],
+        };
+    }
+
+    public static async Task<string[]> GetPermissionKeysAsync(
+        AwardsDbContext db,
+        string? role,
+        CancellationToken cancellationToken = default)
+    {
+        var normalizedRole = AdminRoles.Normalize(role);
+        if (normalizedRole is AdminRoles.Owner or AdminRoles.Creator)
+        {
+            return AllPermissionKeys;
+        }
+
+        var fallback = DefaultPermissionKeys(normalizedRole);
+        var overrideJson = await db.TeamRolePermissions
+            .AsNoTracking()
+            .Where(item => item.Role == normalizedRole)
+            .Select(item => item.PermissionsJson)
+            .FirstOrDefaultAsync(cancellationToken);
+
+        if (string.IsNullOrWhiteSpace(overrideJson))
+        {
+            return fallback;
+        }
+
+        try
+        {
+            return (JsonSerializer.Deserialize<string[]>(overrideJson) ?? fallback)
+                .Where(IsKnownPermission)
+                .Distinct(StringComparer.OrdinalIgnoreCase)
+                .OrderBy(item => item)
+                .ToArray();
+        }
+        catch (JsonException)
+        {
+            return fallback;
+        }
+    }
+
+    public static async Task<bool> HasPermissionAsync(
+        AwardsDbContext db,
+        string? role,
+        string permissionKey,
+        CancellationToken cancellationToken = default)
+    {
+        var permissions = await GetPermissionKeysAsync(db, role, cancellationToken);
+        return permissions.Contains(permissionKey, StringComparer.OrdinalIgnoreCase);
+    }
+
+    public static async Task<bool> HasAnyPermissionAsync(
+        AwardsDbContext db,
+        string? role,
+        IEnumerable<string> permissionKeys,
+        CancellationToken cancellationToken = default)
+    {
+        var permissions = await GetPermissionKeysAsync(db, role, cancellationToken);
+        return permissionKeys.Any(permission => permissions.Contains(permission, StringComparer.OrdinalIgnoreCase));
+    }
+}