gitlawrandjialin
5ef671f047
Relax the dashboard route from canSeeAdmin (strict platform admin) to canSeeOrgAdmin so the access seam can widen the audience past the platform admin — by default platform admin, plus whatever an access extension chooses to admit. The dashboard endpoint takes care of scoping the response per caller. Also move Dashboard under the canSeeOrgAdmin bullet in the access.ts predicate notes.
36 lines
1.3 KiB
TypeScript
36 lines
1.3 KiB
TypeScript
import { applyAccessExtensions } from './access.extensions';
|
|
|
|
export default (initialState: { currentUser?: Global.UserInfo }) => {
|
|
const isPlatformAdmin = !!(
|
|
initialState &&
|
|
initialState.currentUser &&
|
|
initialState.currentUser.is_admin
|
|
);
|
|
const canSeeUser = !!(
|
|
initialState &&
|
|
initialState.currentUser &&
|
|
!initialState.currentUser.is_admin
|
|
);
|
|
|
|
// Predicate roles, top-down by strictness:
|
|
// * `canSeeAdmin` — strictly platform admin (`users.is_admin`).
|
|
// Gates Users.
|
|
// * `canSeeOrgAdmin` — admin-style menus that work cross-org
|
|
// (Dashboard, Resources, Models, Cluster Management). Defaults
|
|
// to platform admin; extensions widen to include org admins.
|
|
// * `canManageCurrentOrg` — pages that only make sense inside a
|
|
// specific org context (member / group management). Defaults to
|
|
// `false`; extensions widen when both an org is selected AND
|
|
// the caller is admin of it.
|
|
// Pass through `applyAccessExtensions` so build-time tooling can
|
|
// widen these without editing this file. Default is a no-op.
|
|
return applyAccessExtensions({
|
|
canSeeAdmin: isPlatformAdmin,
|
|
canSeeOrgAdmin: isPlatformAdmin,
|
|
canManageCurrentOrg: false,
|
|
canSeeUser,
|
|
canDelete: true,
|
|
canLogin: true
|
|
});
|
|
};
|