konnosDashboard
auth-core-roles.ts92 lines · main
1/**
2 * briven-engine roles API for yellow Auth dashboard (Phase 6).
3 * Platform operator session required.
4 */
5
6import { Hono } from 'hono';
7
8import { requireAuthCoreDashboard } from '../middleware/auth-core-guard.js';
9import { BRIVEN_ENGINE_ID, isAuthCoreInitialized } from '../services/auth-core/engine.js';
10import {
11 assignBrivenEngineRole,
12 createBrivenEngineRole,
13 getBrivenEngineUserRoles,
14 listBrivenEngineRoles,
15} from '../services/auth-core/roles.js';
16import type { AppEnv } from '../types/app-env.js';
17
18export const authCoreRolesRouter = new Hono<AppEnv>();
19
20authCoreRolesRouter.use('/v1/auth-core/roles', requireAuthCoreDashboard());
21authCoreRolesRouter.use('/v1/auth-core/roles/*', requireAuthCoreDashboard());
22authCoreRolesRouter.use('/v1/auth-core/users/*/roles', requireAuthCoreDashboard());
23
24authCoreRolesRouter.get('/v1/auth-core/roles', async (c) => {
25 if (!isAuthCoreInitialized()) {
26 return c.json(
27 { engine: BRIVEN_ENGINE_ID, roles: [], code: 'auth_core_sdk_not_ready' },
28 503,
29 );
30 }
31 const projectId = c.req.query('projectId') ?? undefined;
32 const tenantId = c.req.query('tenantId') ?? undefined;
33 return c.json(await listBrivenEngineRoles({ projectId, tenantId }));
34});
35
36authCoreRolesRouter.post('/v1/auth-core/roles', async (c) => {
37 let body: {
38 role?: string;
39 permissions?: string[];
40 projectId?: string;
41 tenantId?: string;
42 } = {};
43 try {
44 body = await c.req.json();
45 } catch {
46 body = {};
47 }
48 if (!body.role) {
49 return c.json({ engine: BRIVEN_ENGINE_ID, code: 'role_required' }, 400);
50 }
51 return c.json(
52 await createBrivenEngineRole(body.role, body.permissions ?? [], {
53 projectId: body.projectId,
54 tenantId: body.tenantId,
55 }),
56 );
57});
58
59authCoreRolesRouter.post('/v1/auth-core/roles/assign', async (c) => {
60 let body: {
61 userId?: string;
62 role?: string;
63 projectId?: string;
64 tenantId?: string;
65 } = {};
66 try {
67 body = await c.req.json();
68 } catch {
69 body = {};
70 }
71 if (!body.userId || !body.role) {
72 return c.json(
73 { engine: BRIVEN_ENGINE_ID, code: 'userId_and_role_required' },
74 400,
75 );
76 }
77 return c.json(
78 await assignBrivenEngineRole(body.userId, body.role, {
79 projectId: body.projectId,
80 tenantId: body.tenantId,
81 }),
82 );
83});
84
85authCoreRolesRouter.get('/v1/auth-core/users/:userId/roles', async (c) => {
86 return c.json(
87 await getBrivenEngineUserRoles(c.req.param('userId'), {
88 projectId: c.req.query('projectId') ?? undefined,
89 tenantId: c.req.query('tenantId') ?? undefined,
90 }),
91 );
92});