34 lines
2.1 KiB
Text
34 lines
2.1 KiB
Text
|
# RBAC — auth feature permissions
|
||
|
|
#
|
||
|
|
# Covers: OTP login flow, session management, account management.
|
||
|
|
# Enable when using rustelo_auth.
|
||
|
|
#
|
||
|
|
# Each field is an array of permission entries for that role.
|
||
|
|
# Concatenate with @ in your site/rbac.ncl:
|
||
|
|
# permissions = auth.admin @ other_feature.admin
|
||
|
|
|
||
|
|
let E = (import "../rbac-base.ncl").effects in
|
||
|
|
|
||
|
|
{
|
||
|
|
admin = [], # admin inherits all via wildcard — no specific auth rules needed
|
||
|
|
|
||
|
|
user = [
|
||
|
|
{ resource = "endpoint", pattern = "/api/server_logout*", outcome = "allow", methods = ["POST"], effects = [] },
|
||
|
|
{ resource = "endpoint", pattern = "/api/server_logout_all*", outcome = "allow", methods = ["POST"], effects = [] },
|
||
|
|
{ resource = "endpoint", pattern = "/api/server_refresh_token*", outcome = "allow", methods = ["POST"], effects = [] },
|
||
|
|
{ resource = "endpoint", pattern = "/api/server_get_session_user*", outcome = "allow", methods = ["POST"], effects = [] },
|
||
|
|
{ resource = "endpoint", pattern = "/api/server_update_display_name*", outcome = "allow", methods = ["POST"], effects = [] },
|
||
|
|
{ resource = "endpoint", pattern = "/api/server_delete_account*", outcome = "allow", methods = ["POST"], effects = [] },
|
||
|
|
],
|
||
|
|
|
||
|
|
guest = [
|
||
|
|
{ resource = "page", pattern = "/login", outcome = "allow", methods = [], effects = [] },
|
||
|
|
{ resource = "page", pattern = "/register", outcome = "allow", methods = [], effects = [] },
|
||
|
|
{ resource = "endpoint", pattern = "/api/auth/*", outcome = "allow", methods = [], effects = [] },
|
||
|
|
{ resource = "endpoint", pattern = "/api/server_request_otp*", outcome = "allow", methods = ["POST"], effects = [] },
|
||
|
|
{ resource = "endpoint", pattern = "/api/server_verify_otp*", outcome = "allow", methods = ["POST"], effects = [] },
|
||
|
|
{ resource = "endpoint", pattern = "/api/server_accept_gdpr*", outcome = "allow", methods = ["POST"], effects = [] },
|
||
|
|
{ resource = "endpoint", pattern = "/api/server_get_session_user*", outcome = "allow", methods = ["POST"], effects = [] },
|
||
|
|
],
|
||
|
|
}
|