Edwin van den Houdt
7ec13d8b59
Replace the FE-computed authorization anti-pattern in BriefStore.editable (derived from the unverified X-Role header) with server-computed decision flags, mirroring the existing HerregistratieDecisionsDto pattern: - Backend: Authz.cs is the single authorization helper — the SAME check (Authz.CanActOn) both gates BriefStore.Review's mutations and computes the BriefDecisionsDto flags shipped on every brief response, so emit and enforce can never drift. New GET /me returns coarse, role-derived capabilities (PRD-0002 SS6). - Every brief endpoint (including send, previously ungated on HttpContext) now returns a fresh BriefViewDto so decisions never go stale after a mutation. - FE: brief.store.ts reads canEdit/canApprove/canReject/canSend off the loaded decisions instead of computing them from currentRole(); the brief.machine carries decisions through every status transition. - New shared/domain/capability.ts + shared/application/access.store.ts + shared/infrastructure/me.adapter.ts: the general capability-spine infrastructure (AccessStore.can(), capabilityGuard) for future routes. Deviates from the original WP-18 draft by NOT renaming auth/domain's Session to a Principal union — ADR-0002 explicitly defers that refactor until a second actor exists, and the brief workflow's drafter/approver identity turned out to be a separate axis from the SSP login session entirely. See docs/backlog/WP-18-abac-capability-spine.md for the full as-built record. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
34 lines
1.4 KiB
TypeScript
34 lines
1.4 KiB
TypeScript
import { Injectable, inject, resource } from '@angular/core';
|
|
import { Result, ok, err } from '@shared/kernel/fp';
|
|
import { Capability } from '@shared/domain/capability';
|
|
import { ApiClient } from '@shared/infrastructure/api-client';
|
|
|
|
const KNOWN: readonly Capability[] = ['brief:approve', 'brief:reject', 'brief:send'];
|
|
|
|
/**
|
|
* Infrastructure adapter for `GET /me` (PRD-0002 §6): the current principal's
|
|
* coarse, role-derived capabilities — nav/menu-level, not tied to any one screen's
|
|
* live status (contrast a screen's own decision DTO, e.g. `BriefViewDto.decisions`).
|
|
*/
|
|
@Injectable({ providedIn: 'root' })
|
|
export class MeAdapter {
|
|
private client = inject(ApiClient);
|
|
|
|
meResource() {
|
|
return resource({ loader: () => this.client.me() });
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Trust-boundary parse. An unrecognized capability string is dropped rather than
|
|
* rejecting the whole response — deny-by-default already covers it (AccessStore.can
|
|
* returns false for anything not in the set), and it lets the backend grow the
|
|
* capability list without breaking an older FE build.
|
|
*/
|
|
export function parseMe(json: unknown): Result<string, Capability[]> {
|
|
if (typeof json !== 'object' || json === null) return err('me: not an object');
|
|
const dto = json as { capabilities?: unknown };
|
|
if (!Array.isArray(dto.capabilities)) return err('me: missing/invalid capabilities');
|
|
return ok(dto.capabilities.filter((c): c is Capability => KNOWN.includes(c as Capability)));
|
|
}
|