hyb-oa/client/src/auth/permissions.ts

const EXPENSE_SELF_SERVICE_PERMISSIONS = [
  "expense.create",
  "expense.view_own",
  "expense.edit_own",
  "expense.delete_own",
  "expense.submit",
  "expense.withdraw",
  "invoice.upload",
  "invoice.view_own",
  "expense.proxy_manage",
] as const;

const LEAVE_SELF_SERVICE_PERMISSIONS = [
  "leave.create",
  "leave.view_own",
  "leave.submit",
] as const;

const PROCUREMENT_SELF_SERVICE_PERMISSIONS = [
  "procurement.create",
  "procurement.view_own",
  "procurement.submit",
] as const;

const TRAVEL_SELF_SERVICE_PERMISSIONS = [
  "travel.create",
  "travel.view_own",
  "travel.submit",
] as const;

const ASSET_SELF_SERVICE_PERMISSIONS = ["asset.view_own"] as const;

const MASTERDATA_VIEW_PERMISSIONS = ["masterdata.view"] as const;
const MASTERDATA_MANAGE_PERMISSIONS = ["masterdata.manage"] as const;

const EMPLOYEE_BASE_PERMISSIONS = [
  ...EXPENSE_SELF_SERVICE_PERMISSIONS,
  ...LEAVE_SELF_SERVICE_PERMISSIONS,
  ...TRAVEL_SELF_SERVICE_PERMISSIONS,
] as const;

const ROLE_PERMISSIONS: Record<string, readonly string[]> = {
  employee: [
    ...EMPLOYEE_BASE_PERMISSIONS,
    ...PROCUREMENT_SELF_SERVICE_PERMISSIONS,
    ...ASSET_SELF_SERVICE_PERMISSIONS,
  ],
  manager: [
    ...EMPLOYEE_BASE_PERMISSIONS,
    ...PROCUREMENT_SELF_SERVICE_PERMISSIONS,
    "expense.approve",
    "expense.transfer",
    "expense.view_all",
    "leave.approve",
    "procurement.approve",
    "procurement.view_all",
    "travel.approve",
    "travel.view_all",
    "asset.view_all",
    "report.dashboard.view",
    "budget.view",
    "budget.manage",
  ],
  ceo: [
    ...EMPLOYEE_BASE_PERMISSIONS,
    ...PROCUREMENT_SELF_SERVICE_PERMISSIONS,
    ...MASTERDATA_VIEW_PERMISSIONS,
    "expense.approve",
    "expense.transfer",
    "expense.view_all",
    "leave.approve",
    "leave.view_all",
    "procurement.approve",
    "procurement.view_all",
    "travel.approve",
    "travel.view_all",
    "asset.view_all",
    "report.dashboard.view",
    "budget.view",
  ],
  finance: [
    ...EMPLOYEE_BASE_PERMISSIONS,
    ...MASTERDATA_VIEW_PERMISSIONS,
    "invoice.manage",
    "invoice.verify",
    "report.dashboard.view",
    "budget.view",
    "expense.approve",
    "expense.finance.pay",
    "expense.view_all",
    "procurement.view_all",
    "travel.view_all",
    "asset.view_all",
  ],
  finance_mgr: [
    ...EMPLOYEE_BASE_PERMISSIONS,
    ...MASTERDATA_MANAGE_PERMISSIONS,
    "invoice.manage",
    "invoice.verify",
    "report.dashboard.view",
    "budget.view",
    "budget.manage",
    "integration.manage",
    "notification.channel.manage",
    "ai.assist",
    "expense.approve",
    "expense.finance.pay",
    "expense.view_all",
    "expense.finance.override_duplicate",
    "procurement.view_all",
    "procurement.manage",
    "travel.view_all",
    "travel.manage",
    "asset.view_all",
    "asset.manage",
    "asset.inventory",
    "system.settings",
    "system.audit.view",
  ],
  administration: [
    "expense.proxy_submit",
    ...EMPLOYEE_BASE_PERMISSIONS,
    "procurement.view_all",
    "procurement.manage",
    "travel.view_all",
    "travel.manage",
    "asset.view_all",
    "asset.manage",
    "asset.transfer",
  ],
  hr: [
    ...LEAVE_SELF_SERVICE_PERMISSIONS,
    "leave.view_all",
    "leave.manage",
    "system.users",
    "system.users_sensitive",
    "expense.view_all",
    "report.dashboard.view",
  ],
  admin: ["*"],
};

function rolePermissions(roleCode: string): readonly string[] {
  return ROLE_PERMISSIONS[roleCode] ?? [];
}

export function resolvePermissionsForRoles(roleCodes: string[]) {
  const permissions = new Set<string>();

  for (const roleCode of roleCodes) {
    for (const permission of rolePermissions(roleCode)) {
      permissions.add(permission);
    }
  }

  return Array.from(permissions);
}

export function hasPermission(permissionCodes: string[], permissionCode: string) {
  return permissionCodes.includes("*") || permissionCodes.includes(permissionCode);
}

export function hasAnyPermission(permissionCodes: string[], candidates: string[]) {
  if (candidates.length === 0) {
    return true;
  }

  return candidates.some((candidate) => hasPermission(permissionCodes, candidate));
}