hyb-oa/server/src/constants/permissions.js

const EXPENSE_SELF_SERVICE_PERMISSIONS = [
  "expense.create",
  "expense.view_own",
  "expense.edit_own",
  "expense.delete_own",
  "expense.submit",
  "expense.withdraw",
  "invoice.upload",
  "invoice.view_own",
  "expense.proxy_manage",
];

const LEAVE_SELF_SERVICE_PERMISSIONS = [
  "leave.create",
  "leave.view_own",
  "leave.submit",
];

const PROCUREMENT_SELF_SERVICE_PERMISSIONS = [
  "procurement.create",
  "procurement.view_own",
  "procurement.submit",
];

const TRAVEL_SELF_SERVICE_PERMISSIONS = [
  "travel.create",
  "travel.view_own",
  "travel.submit",
];

const ASSET_SELF_SERVICE_PERMISSIONS = ["asset.view_own"];
const PROJECT_SELF_SERVICE_PERMISSIONS = ["project.view_own"];

const MASTERDATA_VIEW_PERMISSIONS = ["masterdata.view"];
const MASTERDATA_MANAGE_PERMISSIONS = ["masterdata.manage"];

const EMPLOYEE_BASE_PERMISSIONS = [
  ...EXPENSE_SELF_SERVICE_PERMISSIONS,
  ...LEAVE_SELF_SERVICE_PERMISSIONS,
  ...TRAVEL_SELF_SERVICE_PERMISSIONS,
  ...PROJECT_SELF_SERVICE_PERMISSIONS,
];

const ENTITY_PERMISSION_MAP = {
  reimbursement: {
    create: "expense.create",
    view_own: "expense.view_own",
    view_all: "expense.view_all",
    edit_own: "expense.edit_own",
    delete_own: "expense.delete_own",
    submit: "expense.submit",
    withdraw: "expense.withdraw",
    approve: "expense.approve",
    transfer: "expense.transfer",
  },
  expense: {
    create: "expense.create",
    view_own: "expense.view_own",
    view_all: "expense.view_all",
    edit_own: "expense.edit_own",
    delete_own: "expense.delete_own",
    submit: "expense.submit",
    withdraw: "expense.withdraw",
    approve: "expense.approve",
    transfer: "expense.transfer",
  },
  leave: {
    create: "leave.create",
    view_own: "leave.view_own",
    view_all: "leave.view_all",
    submit: "leave.submit",
    approve: "leave.approve",
    manage: "leave.manage",
  },
  purchase_request: {
    create: "procurement.create",
    view_own: "procurement.view_own",
    view_all: "procurement.view_all",
    submit: "procurement.submit",
    approve: "procurement.approve",
    manage: "procurement.manage",
  },
  procurement: {
    create: "procurement.create",
    view_own: "procurement.view_own",
    view_all: "procurement.view_all",
    submit: "procurement.submit",
    approve: "procurement.approve",
    manage: "procurement.manage",
  },
  travel_request: {
    create: "travel.create",
    view_own: "travel.view_own",
    view_all: "travel.view_all",
    submit: "travel.submit",
    approve: "travel.approve",
    manage: "travel.manage",
  },
  travel: {
    create: "travel.create",
    view_own: "travel.view_own",
    view_all: "travel.view_all",
    submit: "travel.submit",
    approve: "travel.approve",
    manage: "travel.manage",
  },
  project: {
    view_own: "project.view_own",
    view_all: "project.view_all",
    manage: "project.manage",
  },
};

const ROLE_PERMISSIONS = {
  employee: [
    ...EMPLOYEE_BASE_PERMISSIONS,
    ...PROCUREMENT_SELF_SERVICE_PERMISSIONS,
    ...ASSET_SELF_SERVICE_PERMISSIONS,
  ],
  manager: [
    ...EMPLOYEE_BASE_PERMISSIONS,
    ...PROCUREMENT_SELF_SERVICE_PERMISSIONS,
    "expense.approve",
    "expense.transfer",
    "expense.view_all",
    "leave.approve",
    "procurement.approve",
    "procurement.view_all",
    "travel.approve",
    "travel.view_all",
    "asset.view_all",
    "report.dashboard.view",
    "project.view_all",
    "budget.view",
    "project.view_all",
    "project.manage",
    "budget.manage",
    "project.view_all",
    "project.manage",
  ],
  ceo: [
    ...EMPLOYEE_BASE_PERMISSIONS,
    ...PROCUREMENT_SELF_SERVICE_PERMISSIONS,
    ...MASTERDATA_VIEW_PERMISSIONS,
    "expense.approve",
    "expense.transfer",
    "expense.view_all",
    "leave.approve",
    "leave.view_all",
    "procurement.approve",
    "procurement.view_all",
    "travel.approve",
    "travel.view_all",
    "asset.view_all",
    "report.dashboard.view",
    "budget.view",
  ],
  finance: [
    ...EMPLOYEE_BASE_PERMISSIONS,
    ...MASTERDATA_VIEW_PERMISSIONS,
    "invoice.manage",
    "invoice.verify",
    "report.dashboard.view",
    "budget.view",
    "expense.approve",
    "expense.finance.pay",
    "payment.batch.manage",
    "expense.view_all",
    "procurement.view_all",
    "travel.view_all",
    "travel.payment.manage",
    "asset.view_all",
  ],
  finance_mgr: [
    ...EMPLOYEE_BASE_PERMISSIONS,
    ...MASTERDATA_MANAGE_PERMISSIONS,
    "invoice.manage",
    "invoice.verify",
    "report.dashboard.view",
    "budget.view",
    "budget.manage",
    "integration.manage",
    "notification.channel.manage",
    "ai.assist",
    "expense.approve",
    "expense.finance.pay",
    "payment.batch.manage",
    "expense.view_all",
    "expense.finance.override_duplicate",
    "procurement.view_all",
    "procurement.manage",
    "travel.view_all",
    "travel.manage",
    "travel.payment.manage",
    "asset.view_all",
    "asset.manage",
    "asset.inventory",
    "system.settings",
    "system.audit.view",
    "payment.batch.manage",
    "risk.review.manage",
    "project.view_all",
  ],
  administration: [
    "expense.proxy_submit",
    ...EMPLOYEE_BASE_PERMISSIONS,
    "procurement.view_all",
    "procurement.manage",
    "travel.view_all",
    "travel.manage",
    "travel.payment.manage",
    "asset.view_all",
    "asset.manage",
    "asset.transfer",
    "project.view_all",
    "project.manage",
  ],
  hr: [
    ...LEAVE_SELF_SERVICE_PERMISSIONS,
    "leave.view_all",
    "leave.manage",
    "system.users",
    "system.users_sensitive",
    "expense.view_all",
    "report.dashboard.view",
  ],
  admin: ["*"],
};

function getRolePermissions(roleCode) {
  return ROLE_PERMISSIONS[roleCode] ?? [];
}

function resolvePermissionsForRoles(roleCodes) {
  const permissions = new Set();

  for (const roleCode of roleCodes ?? []) {
    for (const permission of getRolePermissions(roleCode)) {
      permissions.add(permission);
    }
  }

  return Array.from(permissions);
}

function hasPermission(permissionCodes, permission) {
  return permissionCodes.includes("*") || permissionCodes.includes(permission);
}

function resolveEntityPermission(entityType, action) {
  return ENTITY_PERMISSION_MAP[entityType]?.[action] ?? null;
}

module.exports = {
  ROLE_PERMISSIONS,
  resolvePermissionsForRoles,
  hasPermission,
  resolveEntityPermission,
};