Authorization

Copy/**
 * Permission Rules:
 * - DEVELOPER: full access across schools
 * - ADMIN: full access within their school
 * - TEACHER: read all in school, edit own profile
 * - STAFF, ACCOUNTANT: read-only
 */
 
import { UserRole } from "@prisma/client"
 
export type TeacherAction =
  | "create"
  | "read"
  | "update"
  | "delete"
  | "export"
  | "bulk_action"
  | "assign_class"
 
export interface AuthContext {
  userId: string
  role: UserRole
  schoolId: string | null
}
 
export interface TeacherContext {
  id?: string
  schoolId?: string
  userId?: string | null
}
 
export function checkTeacherPermission(
  auth: AuthContext,
  action: TeacherAction,
  teacher?: TeacherContext
): boolean {
  const { role, userId, schoolId } = auth
 
  if (role === "DEVELOPER") return true
  if (!schoolId) return false
 
  if (role === "ADMIN") {
    if (!teacher?.schoolId) return true
    return schoolId === teacher.schoolId
  }
 
  if (role === "TEACHER") {
    if (action === "read") return schoolId === teacher?.schoolId
    if (action === "update")
      return teacher?.userId === userId && schoolId === teacher.schoolId
    return false
  }
 
  if (["STAFF", "ACCOUNTANT"].includes(role)) {
    return action === "read" || action === "export"
  }
 
  return false
}
 
export function assertTeacherPermission(
  auth: AuthContext,
  action: TeacherAction,
  teacher?: TeacherContext
): void {
  if (!checkTeacherPermission(auth, action, teacher)) {
    throw new Error(`Unauthorized: ${auth.role} cannot ${action} teacher`)
  }
}
 
export function canCreateTeacher(role: UserRole): boolean {
  return ["DEVELOPER", "ADMIN"].includes(role)
}
 
export function getAllowedActions(role: UserRole): TeacherAction[] {
  switch (role) {
    case "DEVELOPER":
    case "ADMIN":
      return [
        "create",
        "read",
        "update",
        "delete",
        "export",
        "bulk_action",
        "assign_class",
      ]
    case "TEACHER":
      return ["read", "update"]
    case "STAFF":
    case "ACCOUNTANT":
      return ["read", "export"]
    default:
      return []
  }
}

Copy/**
 * | Role     | Create | Read | Update Own | Update Any | Delete Own | Enroll |
 * |----------|--------|------|------------|------------|------------|--------|
 * | DEVELOPER|   Y    |  Y   |     Y      |     Y      |     Y      |   Y    |
 * | ADMIN    |   Y    |  Y   |     Y      |     Y      |     Y      |   Y    |
 * | TEACHER  |   Y    |  Y   |     Y      |     N      |     Y      |   Y    |
 * | STUDENT  |   N    |  Y   |     N      |     N      |     N      |   Y    |
 */
 
if (role === "TEACHER") {
  if (action === "create") return true
  if (!course?.userId) return false
  return course.userId === userId // ownership check
}