Art-gallery/server/permissions.js

/** Fine-grained curator tool permissions. Admins are treated as having all. */
const ALL_PERMISSIONS = [
  'images',
  'checkup',
  'curator_notes',
  'translations',
  'influences',
  'tours',
  'users',
];

function normalizePermissions(raw) {
  if (!Array.isArray(raw)) return [];
  const allowed = new Set(ALL_PERMISSIONS);
  const out = [];
  for (const key of raw) {
    if (typeof key === 'string' && allowed.has(key) && !out.includes(key)) {
      out.push(key);
    }
  }
  return out;
}

function effectivePermissions(user) {
  if (!user) return [];
  if (user.role === 'admin') return [...ALL_PERMISSIONS];
  return normalizePermissions(user.permissions);
}

function hasPermission(user, permission) {
  if (!user || !permission) return false;
  if (user.role === 'admin') return true;
  return normalizePermissions(user.permissions).includes(permission);
}

module.exports = {
  ALL_PERMISSIONS,
  normalizePermissions,
  effectivePermissions,
  hasPermission,
};