Initial curated ITWorx_MCP_Hub source from 368fba691ea8d23403b4d56b53b5ec670d7c5020

apps/web/src/rbac.ts

@@ -0,0 +1,44 @@
+import type { ManagementRole } from "./contracts";
+export type { ManagementRole };
+
+export type ManagementAction =
+  | "dashboard.read"
+  | "resource.read"
+  | "audit.read"
+  | "policy.simulate"
+  | "catalog.preview"
+  | "tool.test"
+  | "tool.invoke"
+  | "operations.check"
+  | "client.read"
+  | "client.bootstrap"
+  | "client.disable"
+  | "client.revoke"
+  | "client.create"
+  | "catalog.apply";
+
+/** Mirrors services/control_api/authz.py's ENDPOINT_PERMISSIONS exactly.
+ * This is a client-side hide-only affordance, never an authorization
+ * boundary -- services/control_api/authz.py's check_role() is what
+ * actually enforces every one of these actions server-side. */
+const PERMISSIONS: Record<ManagementAction, readonly ManagementRole[]> = {
+  "dashboard.read": ["viewer", "auditor", "operator", "admin"],
+  "resource.read": ["viewer", "auditor", "operator", "admin"],
+  "audit.read": ["auditor", "operator", "admin"],
+  "policy.simulate": ["viewer", "auditor", "operator", "admin"],
+  "catalog.preview": ["viewer", "auditor", "operator", "admin"],
+  "tool.test": ["operator", "admin"],
+  "tool.invoke": ["operator", "admin"],
+  "operations.check": ["operator", "admin"],
+  "client.read": ["viewer", "auditor", "operator", "admin"],
+  "client.bootstrap": ["operator", "admin"],
+  "client.disable": ["operator", "admin"],
+  "client.revoke": ["operator", "admin"],
+  "client.create": ["admin"],
+  "catalog.apply": ["admin"],
+};
+
+export function can(roles: readonly ManagementRole[], action: ManagementAction): boolean {
+  const allowed = PERMISSIONS[action];
+  return roles.some((role) => allowed.includes(role));
+}