All files / web/src/lib/auth resource-policies.ts

100% Statements 35/35
100% Branches 0/0
100% Functions 0/0
100% Lines 35/35

Press n or j to go to the next uncovered block, b, p or k for the previous block.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 361x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x  
/**
 * Static resource-level policies for Casbin Layer 2.
 *
 * These define what actions each relationship-role can perform on resources.
 * Seeded into casbin_rules table on enforcer initialization.
 *
 * Format: [ptype, sub, dom, obj, act]
 * - ptype: 'p' for policy rules
 * - sub: role name (parent, teacher-present, teacher-enrolled, teacher)
 * - dom: '*' (applies to all domains of this role)
 * - obj: resource type (player, classroom)
 * - act: action name
 */
export const RESOURCE_POLICIES: [string, string, string, string, string][] = [
  // Parent can do everything with their child
  ['p', 'parent', '*', 'player', 'view'],
  ['p', 'parent', '*', 'player', 'start-session'],
  ['p', 'parent', '*', 'player', 'observe'],
  ['p', 'parent', '*', 'player', 'control-tutorial'],
  ['p', 'parent', '*', 'player', 'control-abacus'],
 
  // Teacher-present (student is in their classroom) — same as parent
  ['p', 'teacher-present', '*', 'player', 'view'],
  ['p', 'teacher-present', '*', 'player', 'start-session'],
  ['p', 'teacher-present', '*', 'player', 'observe'],
  ['p', 'teacher-present', '*', 'player', 'control-tutorial'],
  ['p', 'teacher-present', '*', 'player', 'control-abacus'],
 
  // Teacher-enrolled (student enrolled but not present) — view only
  ['p', 'teacher-enrolled', '*', 'player', 'view'],
 
  // Teacher role for classroom management
  ['p', 'teacher', '*', 'classroom', 'manage'],
  ['p', 'teacher', '*', 'classroom', 'view'],
]