b81f5ac5dd
All checks were successful
dev - build & deploy naar test / build-and-deploy (push) Successful in 56s
49 lines
2.1 KiB
JavaScript
49 lines
2.1 KiB
JavaScript
/* teach - centrale permissiematrix voor de vaste rollen, inclusief ouder.
|
|
Gespiegeld in src/permissions.js (geen bundler in dit project, dus twee bestanden
|
|
die dezelfde waarden hand-in-hand bijhouden). */
|
|
const PERMISSIONS = {
|
|
'admin.access': ['super', 'admin', 'teacher'],
|
|
'curriculum.view': ['super', 'admin', 'teacher', 'parent'],
|
|
'password.own.change': ['super', 'admin', 'teacher'],
|
|
'schools.manage': ['super'],
|
|
'schools.resetPasswords': ['super', 'admin'],
|
|
'classes.view': ['super', 'admin', 'teacher'],
|
|
'classes.manage': ['super', 'admin'],
|
|
'users.manage': ['super', 'admin', 'teacher'],
|
|
'users.staffCredentials': ['super', 'admin'],
|
|
'users.genpw': ['super', 'admin', 'teacher'],
|
|
'users.role.change': ['super'],
|
|
'assignments.manage': ['super', 'admin', 'teacher'],
|
|
'progress.view': ['super', 'admin', 'teacher'],
|
|
'shared.global.manage': ['super'],
|
|
'content.manage': ['super'],
|
|
'shared.school.manage': ['super', 'admin', 'teacher'],
|
|
};
|
|
|
|
const CREATABLE_ROLES = {
|
|
super: ['super', 'admin', 'teacher', 'pupil'],
|
|
admin: ['admin', 'teacher', 'pupil'],
|
|
teacher: ['pupil'],
|
|
};
|
|
|
|
/* Een systeemmanager kan uitsluitend de clientweergave van een andere rol
|
|
simuleren. Het HttpOnly-account en alle serverautorisatie blijven ongewijzigd. */
|
|
const VIEW_ROLES = ["super","admin","teacher","parent","pupil"];
|
|
let VIEW_AS_ROLE = "super";
|
|
function setActiveViewRole(role){
|
|
VIEW_AS_ROLE = VIEW_ROLES.includes(role) ? role : "super";
|
|
}
|
|
function activeRole(){
|
|
if(!currentUser) return null;
|
|
return currentUser.role==="super" ? VIEW_AS_ROLE : currentUser.role;
|
|
}
|
|
function activeRoles(){
|
|
if(!currentUser) return [];
|
|
const role=activeRole();
|
|
return role===currentUser.role ? [currentUser.role,...(currentUser.extraRoles||[])] : [role];
|
|
}
|
|
/* can(action) gebruikt het actieve weergaveprofiel. De server blijft iedere
|
|
aanvraag vanzelf tegen het echte account autoriseren. */
|
|
function can(action){
|
|
return (PERMISSIONS[action] || []).some(r => activeRoles().includes(r));
|
|
}
|