Iteration 1: Auth (lokale Accounts), RBAC, RLS-Policies, i18n
- Auth.js v5 mit Credentials-Provider: Argon2id-Verifikation, JWT-Session mit Mandanten-Kontext, Rollen und Permissions; Login-/Logout-Flow (deutsch) - RBAC-Katalog (28 Permissions, 5 Rollen-Blueprints) mit serverseitigem requirePermission; Seed legt Demo-Mandant und 4 Demo-Nutzer an - Route-Gate über Next-16-proxy.ts (UX-Ebene), autoritative Prüfung serverseitig via requireSession/requirePermission - Prisma-Migrationen: init + Row-Level-Security-Policies (zweite Verteidigungslinie, Scharfschaltung in Härtungs-Iteration dokumentiert) - i18n-Gerüst mit next-intl (de aktiv, en vorbereitet), Audit-Log-Helper - Login/Logout end-to-end im Browser verifiziert; Build/Lint/Typecheck grün Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Martin
@@ -0,0 +1,3 @@
|
||||
import { handlers } from "@/server/auth";
|
||||
|
||||
export const { GET, POST } = handlers;
|
||||
@@ -0,0 +1,43 @@
|
||||
import { getTranslations } from "next-intl/server";
|
||||
import { redirect } from "next/navigation";
|
||||
import { auth, signOut } from "@/server/auth";
|
||||
|
||||
export default async function DashboardPage() {
|
||||
const session = await auth();
|
||||
if (!session?.user) redirect("/login");
|
||||
|
||||
const t = await getTranslations("dashboard");
|
||||
const tc = await getTranslations("common");
|
||||
|
||||
async function logout() {
|
||||
"use server";
|
||||
await signOut({ redirectTo: "/login" });
|
||||
}
|
||||
|
||||
return (
|
||||
<main className="mx-auto w-full max-w-5xl flex-1 p-6">
|
||||
<header className="flex items-center justify-between border-b border-slate-200 pb-4">
|
||||
<h1 className="text-xl font-semibold">{t("title")}</h1>
|
||||
<form action={logout}>
|
||||
<button
|
||||
type="submit"
|
||||
className="rounded-md border border-slate-300 px-3 py-1.5 text-sm hover:bg-slate-100"
|
||||
>
|
||||
{tc("logout")}
|
||||
</button>
|
||||
</form>
|
||||
</header>
|
||||
|
||||
<section className="mt-6 rounded-xl border border-slate-200 bg-white p-6 shadow-sm">
|
||||
<p className="text-lg">{t("welcome", { name: session.user.name ?? "" })}</p>
|
||||
<dl className="mt-4 grid grid-cols-2 gap-2 text-sm">
|
||||
<dt className="text-slate-500">{t("tenant")}</dt>
|
||||
<dd>{session.user.tenantSlug}</dd>
|
||||
<dt className="text-slate-500">{t("roles")}</dt>
|
||||
<dd>{session.user.roles.join(", ")}</dd>
|
||||
</dl>
|
||||
<p className="mt-6 text-sm text-slate-400">{t("placeholder")}</p>
|
||||
</section>
|
||||
</main>
|
||||
);
|
||||
}
|
||||
+5
-10
@@ -1,8 +1,10 @@
|
||||
@import "tailwindcss";
|
||||
|
||||
/* Helles Basis-Theme; Dark-Mode folgt kontrolliert mit dem shadcn/ui-Theming
|
||||
(kein automatisches prefers-color-scheme, damit Komponenten konsistent bleiben). */
|
||||
:root {
|
||||
--background: #ffffff;
|
||||
--foreground: #171717;
|
||||
--background: #f8fafc;
|
||||
--foreground: #0f172a;
|
||||
}
|
||||
|
||||
@theme inline {
|
||||
@@ -12,15 +14,8 @@
|
||||
--font-mono: var(--font-geist-mono);
|
||||
}
|
||||
|
||||
@media (prefers-color-scheme: dark) {
|
||||
:root {
|
||||
--background: #0a0a0a;
|
||||
--foreground: #ededed;
|
||||
}
|
||||
}
|
||||
|
||||
body {
|
||||
background: var(--background);
|
||||
color: var(--foreground);
|
||||
font-family: Arial, Helvetica, sans-serif;
|
||||
font-family: var(--font-sans), Arial, Helvetica, sans-serif;
|
||||
}
|
||||
|
||||
+12
-5
@@ -1,5 +1,7 @@
|
||||
import type { Metadata } from "next";
|
||||
import { Geist, Geist_Mono } from "next/font/google";
|
||||
import { NextIntlClientProvider } from "next-intl";
|
||||
import { getLocale } from "next-intl/server";
|
||||
import "./globals.css";
|
||||
|
||||
const geistSans = Geist({
|
||||
@@ -13,21 +15,26 @@ const geistMono = Geist_Mono({
|
||||
});
|
||||
|
||||
export const metadata: Metadata = {
|
||||
title: "Create Next App",
|
||||
description: "Generated by create next app",
|
||||
title: "ISMS-Tool",
|
||||
description:
|
||||
"Informationssicherheits-Managementsystem für ISO/IEC 27001:2022 und TISAX/VDA-ISA",
|
||||
};
|
||||
|
||||
export default function RootLayout({
|
||||
export default async function RootLayout({
|
||||
children,
|
||||
}: Readonly<{
|
||||
children: React.ReactNode;
|
||||
}>) {
|
||||
const locale = await getLocale();
|
||||
|
||||
return (
|
||||
<html
|
||||
lang="en"
|
||||
lang={locale}
|
||||
className={`${geistSans.variable} ${geistMono.variable} h-full antialiased`}
|
||||
>
|
||||
<body className="min-h-full flex flex-col">{children}</body>
|
||||
<body className="min-h-full flex flex-col bg-slate-50 text-slate-900">
|
||||
<NextIntlClientProvider>{children}</NextIntlClientProvider>
|
||||
</body>
|
||||
</html>
|
||||
);
|
||||
}
|
||||
|
||||
@@ -0,0 +1,104 @@
|
||||
import { getTranslations } from "next-intl/server";
|
||||
import { redirect } from "next/navigation";
|
||||
import { AuthError } from "next-auth";
|
||||
import { auth, signIn } from "@/server/auth";
|
||||
|
||||
export default async function LoginPage({
|
||||
searchParams,
|
||||
}: {
|
||||
searchParams: Promise<{ error?: string; callbackUrl?: string }>;
|
||||
}) {
|
||||
const t = await getTranslations("login");
|
||||
const tc = await getTranslations("common");
|
||||
const { error, callbackUrl } = await searchParams;
|
||||
|
||||
// Already signed in → straight to the app
|
||||
const session = await auth();
|
||||
if (session?.user) redirect("/dashboard");
|
||||
|
||||
async function login(formData: FormData) {
|
||||
"use server";
|
||||
const target = (formData.get("callbackUrl") as string) || "/dashboard";
|
||||
try {
|
||||
await signIn("credentials", {
|
||||
email: formData.get("email"),
|
||||
password: formData.get("password"),
|
||||
tenant: formData.get("tenant"),
|
||||
redirectTo: target,
|
||||
});
|
||||
} catch (err) {
|
||||
if (err instanceof AuthError) {
|
||||
redirect(`/login?error=1${target !== "/dashboard" ? `&callbackUrl=${encodeURIComponent(target)}` : ""}`);
|
||||
}
|
||||
throw err; // NEXT_REDIRECT from a successful signIn must propagate
|
||||
}
|
||||
}
|
||||
|
||||
return (
|
||||
<main className="flex flex-1 items-center justify-center p-6">
|
||||
<div className="w-full max-w-sm rounded-xl border border-slate-200 bg-white p-8 shadow-sm">
|
||||
<h1 className="text-xl font-semibold">{tc("appName")}</h1>
|
||||
<h2 className="mt-1 text-sm text-slate-500">{t("subtitle")}</h2>
|
||||
|
||||
{error && (
|
||||
<p
|
||||
role="alert"
|
||||
className="mt-4 rounded-md bg-red-50 px-3 py-2 text-sm text-red-700"
|
||||
>
|
||||
{t("error")}
|
||||
</p>
|
||||
)}
|
||||
|
||||
<form action={login} className="mt-6 space-y-4">
|
||||
<input type="hidden" name="callbackUrl" value={callbackUrl ?? ""} />
|
||||
<div>
|
||||
<label htmlFor="email" className="block text-sm font-medium">
|
||||
{t("email")}
|
||||
</label>
|
||||
<input
|
||||
id="email"
|
||||
name="email"
|
||||
type="email"
|
||||
required
|
||||
autoComplete="email"
|
||||
className="mt-1 w-full rounded-md border border-slate-300 px-3 py-2 text-sm focus:border-blue-500 focus:outline-none focus:ring-1 focus:ring-blue-500"
|
||||
/>
|
||||
</div>
|
||||
<div>
|
||||
<label htmlFor="password" className="block text-sm font-medium">
|
||||
{t("password")}
|
||||
</label>
|
||||
<input
|
||||
id="password"
|
||||
name="password"
|
||||
type="password"
|
||||
required
|
||||
autoComplete="current-password"
|
||||
className="mt-1 w-full rounded-md border border-slate-300 px-3 py-2 text-sm focus:border-blue-500 focus:outline-none focus:ring-1 focus:ring-blue-500"
|
||||
/>
|
||||
</div>
|
||||
<div>
|
||||
<label htmlFor="tenant" className="block text-sm font-medium">
|
||||
{t("tenant")}
|
||||
</label>
|
||||
<input
|
||||
id="tenant"
|
||||
name="tenant"
|
||||
type="text"
|
||||
autoComplete="organization"
|
||||
title={t("tenantHint")}
|
||||
className="mt-1 w-full rounded-md border border-slate-300 px-3 py-2 text-sm focus:border-blue-500 focus:outline-none focus:ring-1 focus:ring-blue-500"
|
||||
/>
|
||||
<p className="mt-1 text-xs text-slate-400">{t("tenantHint")}</p>
|
||||
</div>
|
||||
<button
|
||||
type="submit"
|
||||
className="w-full rounded-md bg-blue-600 px-3 py-2 text-sm font-medium text-white hover:bg-blue-700 focus:outline-none focus:ring-2 focus:ring-blue-500 focus:ring-offset-2"
|
||||
>
|
||||
{t("submit")}
|
||||
</button>
|
||||
</form>
|
||||
</div>
|
||||
</main>
|
||||
);
|
||||
}
|
||||
+2
-62
@@ -1,65 +1,5 @@
|
||||
import Image from "next/image";
|
||||
import { redirect } from "next/navigation";
|
||||
|
||||
export default function Home() {
|
||||
return (
|
||||
<div className="flex flex-col flex-1 items-center justify-center bg-zinc-50 font-sans dark:bg-black">
|
||||
<main className="flex flex-1 w-full max-w-3xl flex-col items-center justify-between py-32 px-16 bg-white dark:bg-black sm:items-start">
|
||||
<Image
|
||||
className="dark:invert"
|
||||
src="/next.svg"
|
||||
alt="Next.js logo"
|
||||
width={100}
|
||||
height={20}
|
||||
priority
|
||||
/>
|
||||
<div className="flex flex-col items-center gap-6 text-center sm:items-start sm:text-left">
|
||||
<h1 className="max-w-xs text-3xl font-semibold leading-10 tracking-tight text-black dark:text-zinc-50">
|
||||
To get started, edit the page.tsx file.
|
||||
</h1>
|
||||
<p className="max-w-md text-lg leading-8 text-zinc-600 dark:text-zinc-400">
|
||||
Looking for a starting point or more instructions? Head over to{" "}
|
||||
<a
|
||||
href="https://vercel.com/templates?framework=next.js&utm_source=create-next-app&utm_medium=appdir-template-tw&utm_campaign=create-next-app"
|
||||
className="font-medium text-zinc-950 dark:text-zinc-50"
|
||||
>
|
||||
Templates
|
||||
</a>{" "}
|
||||
or the{" "}
|
||||
<a
|
||||
href="https://nextjs.org/learn?utm_source=create-next-app&utm_medium=appdir-template-tw&utm_campaign=create-next-app"
|
||||
className="font-medium text-zinc-950 dark:text-zinc-50"
|
||||
>
|
||||
Learning
|
||||
</a>{" "}
|
||||
center.
|
||||
</p>
|
||||
</div>
|
||||
<div className="flex flex-col gap-4 text-base font-medium sm:flex-row">
|
||||
<a
|
||||
className="flex h-12 w-full items-center justify-center gap-2 rounded-full bg-foreground px-5 text-background transition-colors hover:bg-[#383838] dark:hover:bg-[#ccc] md:w-[158px]"
|
||||
href="https://vercel.com/new?utm_source=create-next-app&utm_medium=appdir-template-tw&utm_campaign=create-next-app"
|
||||
target="_blank"
|
||||
rel="noopener noreferrer"
|
||||
>
|
||||
<Image
|
||||
className="dark:invert"
|
||||
src="/vercel.svg"
|
||||
alt="Vercel logomark"
|
||||
width={16}
|
||||
height={16}
|
||||
/>
|
||||
Deploy Now
|
||||
</a>
|
||||
<a
|
||||
className="flex h-12 w-full items-center justify-center rounded-full border border-solid border-black/[.08] px-5 transition-colors hover:border-transparent hover:bg-black/[.04] dark:border-white/[.145] dark:hover:bg-[#1a1a1a] md:w-[158px]"
|
||||
href="https://nextjs.org/docs?utm_source=create-next-app&utm_medium=appdir-template-tw&utm_campaign=create-next-app"
|
||||
target="_blank"
|
||||
rel="noopener noreferrer"
|
||||
>
|
||||
Documentation
|
||||
</a>
|
||||
</div>
|
||||
</main>
|
||||
</div>
|
||||
);
|
||||
redirect("/dashboard");
|
||||
}
|
||||
|
||||
@@ -0,0 +1,13 @@
|
||||
import { getRequestConfig } from "next-intl/server";
|
||||
|
||||
/**
|
||||
* i18n scaffold (SPEC §7): all UI strings come from the message catalog.
|
||||
* MVP is fixed to "de"; per-user locale (en) is prepared — switch here later.
|
||||
*/
|
||||
export default getRequestConfig(async () => {
|
||||
const locale = "de";
|
||||
return {
|
||||
locale,
|
||||
messages: (await import(`../../messages/${locale}.json`)).default,
|
||||
};
|
||||
});
|
||||
@@ -0,0 +1,34 @@
|
||||
import { NextResponse, type NextRequest } from "next/server";
|
||||
|
||||
/**
|
||||
* Route gate (Next.js 16 proxy, formerly middleware): redirects anonymous
|
||||
* visitors to /login. This is a UX-level gate only — authoritative checks
|
||||
* happen server-side via requireSession()/requirePermission().
|
||||
*/
|
||||
|
||||
const PUBLIC_PATHS = ["/login", "/api/auth"];
|
||||
|
||||
export function proxy(request: NextRequest) {
|
||||
const { pathname } = request.nextUrl;
|
||||
|
||||
if (PUBLIC_PATHS.some((p) => pathname === p || pathname.startsWith(p + "/"))) {
|
||||
return NextResponse.next();
|
||||
}
|
||||
|
||||
const hasSessionCookie =
|
||||
request.cookies.has("authjs.session-token") ||
|
||||
request.cookies.has("__Secure-authjs.session-token");
|
||||
|
||||
if (!hasSessionCookie) {
|
||||
const loginUrl = new URL("/login", request.url);
|
||||
if (pathname !== "/") loginUrl.searchParams.set("callbackUrl", pathname);
|
||||
return NextResponse.redirect(loginUrl);
|
||||
}
|
||||
|
||||
return NextResponse.next();
|
||||
}
|
||||
|
||||
export const config = {
|
||||
// Everything except static assets
|
||||
matcher: ["/((?!_next/static|_next/image|favicon.ico|.*\\.(?:svg|png|jpg|ico)).*)"],
|
||||
};
|
||||
@@ -0,0 +1,28 @@
|
||||
import { prisma } from "./db";
|
||||
|
||||
/**
|
||||
* Audit trail (SPEC §5 AuditLog, §10): every writing action creates an entry.
|
||||
* Uses the raw client on purpose — audit writes must never be silently
|
||||
* filtered, and tenantId is passed explicitly by the caller.
|
||||
*/
|
||||
export async function writeAuditLog(entry: {
|
||||
tenantId: string;
|
||||
actorId?: string;
|
||||
action: "create" | "update" | "delete" | "login" | "logout" | "export" | "import";
|
||||
entity: string;
|
||||
entityId?: string;
|
||||
before?: unknown;
|
||||
after?: unknown;
|
||||
}) {
|
||||
await prisma.auditLog.create({
|
||||
data: {
|
||||
tenantId: entry.tenantId,
|
||||
actorId: entry.actorId,
|
||||
action: entry.action,
|
||||
entity: entry.entity,
|
||||
entityId: entry.entityId,
|
||||
before: entry.before as object | undefined,
|
||||
after: entry.after as object | undefined,
|
||||
},
|
||||
});
|
||||
}
|
||||
@@ -0,0 +1,119 @@
|
||||
import NextAuth from "next-auth";
|
||||
import Credentials from "next-auth/providers/credentials";
|
||||
import { verify } from "@node-rs/argon2";
|
||||
import { z } from "zod";
|
||||
import { prisma } from "./db";
|
||||
|
||||
/**
|
||||
* Auth.js (NextAuth v5) with local credentials (MVP, see docs/SPEC.md §0).
|
||||
* JWT strategy: tenant context, roles and permissions are resolved at login
|
||||
* and carried in the token — a role change becomes effective at next login.
|
||||
* TOTP-2FA and OIDC/SAML are planned extensions (SPEC §13).
|
||||
*/
|
||||
|
||||
const credentialsSchema = z.object({
|
||||
email: z.string().email(),
|
||||
password: z.string().min(1),
|
||||
// Optional: disambiguates when the same e-mail exists in several tenants.
|
||||
tenant: z.string().optional(),
|
||||
});
|
||||
|
||||
export class LoginError extends Error {}
|
||||
|
||||
export const { handlers, auth, signIn, signOut } = NextAuth({
|
||||
session: { strategy: "jwt" },
|
||||
pages: { signIn: "/login" },
|
||||
providers: [
|
||||
Credentials({
|
||||
credentials: {
|
||||
email: {},
|
||||
password: {},
|
||||
tenant: {},
|
||||
},
|
||||
authorize: async (raw) => {
|
||||
const parsed = credentialsSchema.safeParse(raw);
|
||||
if (!parsed.success) return null;
|
||||
const { email, password, tenant } = parsed.data;
|
||||
|
||||
const users = await prisma.user.findMany({
|
||||
where: {
|
||||
email: email.toLowerCase(),
|
||||
status: "ACTIVE",
|
||||
tenant: {
|
||||
status: "ACTIVE",
|
||||
...(tenant ? { slug: tenant.toLowerCase() } : {}),
|
||||
},
|
||||
},
|
||||
include: {
|
||||
tenant: true,
|
||||
userRoles: {
|
||||
include: {
|
||||
role: {
|
||||
include: {
|
||||
rolePermissions: { include: { permission: true } },
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
});
|
||||
|
||||
// Same e-mail in several tenants and no slug given → cannot decide.
|
||||
if (users.length !== 1) return null;
|
||||
const user = users[0];
|
||||
|
||||
const valid = await verify(user.passwordHash, password);
|
||||
if (!valid) return null;
|
||||
|
||||
const roles = user.userRoles.map((ur) => ur.role.key);
|
||||
const permissions = [
|
||||
...new Set(
|
||||
user.userRoles.flatMap((ur) =>
|
||||
ur.role.rolePermissions.map((rp) => rp.permission.key)
|
||||
)
|
||||
),
|
||||
];
|
||||
|
||||
return {
|
||||
id: user.id,
|
||||
email: user.email,
|
||||
name: user.name,
|
||||
tenantId: user.tenantId,
|
||||
tenantSlug: user.tenant.slug,
|
||||
roles,
|
||||
permissions,
|
||||
isPlatformAdmin: user.isPlatformAdmin,
|
||||
};
|
||||
},
|
||||
}),
|
||||
],
|
||||
callbacks: {
|
||||
jwt({ token, user }) {
|
||||
if (user) {
|
||||
token.userId = user.id!;
|
||||
token.tenantId = user.tenantId;
|
||||
token.tenantSlug = user.tenantSlug;
|
||||
token.roles = user.roles;
|
||||
token.permissions = user.permissions;
|
||||
token.isPlatformAdmin = user.isPlatformAdmin;
|
||||
}
|
||||
return token;
|
||||
},
|
||||
session({ session, token }) {
|
||||
session.user.id = token.userId;
|
||||
session.user.tenantId = token.tenantId;
|
||||
session.user.tenantSlug = token.tenantSlug;
|
||||
session.user.roles = token.roles;
|
||||
session.user.permissions = token.permissions;
|
||||
session.user.isPlatformAdmin = token.isPlatformAdmin;
|
||||
return session;
|
||||
},
|
||||
},
|
||||
});
|
||||
|
||||
/** Session guard for server components / route handlers. */
|
||||
export async function requireSession() {
|
||||
const session = await auth();
|
||||
if (!session?.user) throw new Error("Nicht angemeldet");
|
||||
return session;
|
||||
}
|
||||
@@ -0,0 +1,152 @@
|
||||
/**
|
||||
* RBAC catalog: granular permissions bundled into per-tenant roles.
|
||||
* See docs/SPEC.md §3. Permissions are global rows (no tenantId),
|
||||
* roles are created per tenant from ROLE_DEFS at tenant provisioning.
|
||||
*/
|
||||
|
||||
export const PERMISSIONS = [
|
||||
// Administration
|
||||
"tenant:manage",
|
||||
"user:read",
|
||||
"user:manage",
|
||||
// Assets & BIA (one module)
|
||||
"asset:read",
|
||||
"asset:write",
|
||||
"bia:read",
|
||||
"bia:write",
|
||||
// Risk
|
||||
"risk:read",
|
||||
"risk:write",
|
||||
"risk:accept",
|
||||
// Compliance
|
||||
"soa:read",
|
||||
"soa:write",
|
||||
// Measures / tasks
|
||||
"measure:read",
|
||||
"measure:write",
|
||||
// Policies
|
||||
"policy:read",
|
||||
"policy:write",
|
||||
"policy:approve",
|
||||
// Incidents
|
||||
"incident:report",
|
||||
"incident:manage",
|
||||
// Audits
|
||||
"audit:read",
|
||||
"audit:conduct",
|
||||
// Suppliers
|
||||
"supplier:read",
|
||||
"supplier:write",
|
||||
// Evidence / documents
|
||||
"evidence:read",
|
||||
"evidence:write",
|
||||
// Reporting / management review
|
||||
"report:read",
|
||||
"review:manage",
|
||||
// Chat
|
||||
"chat:use",
|
||||
] as const;
|
||||
|
||||
export type Permission = (typeof PERMISSIONS)[number];
|
||||
|
||||
/** Role blueprints instantiated for every tenant (key → name + permissions). */
|
||||
export const ROLE_DEFS: Record<
|
||||
string,
|
||||
{ name: string; permissions: readonly Permission[] }
|
||||
> = {
|
||||
"tenant-admin": {
|
||||
name: "Mandanten-Admin",
|
||||
permissions: ["tenant:manage", "user:read", "user:manage", "report:read", "chat:use"],
|
||||
},
|
||||
isb: {
|
||||
name: "ISB / CISO",
|
||||
permissions: [
|
||||
"user:read",
|
||||
"asset:read",
|
||||
"asset:write",
|
||||
"bia:read",
|
||||
"bia:write",
|
||||
"risk:read",
|
||||
"risk:write",
|
||||
"risk:accept",
|
||||
"soa:read",
|
||||
"soa:write",
|
||||
"measure:read",
|
||||
"measure:write",
|
||||
"policy:read",
|
||||
"policy:write",
|
||||
"policy:approve",
|
||||
"incident:report",
|
||||
"incident:manage",
|
||||
"audit:read",
|
||||
"supplier:read",
|
||||
"supplier:write",
|
||||
"evidence:read",
|
||||
"evidence:write",
|
||||
"report:read",
|
||||
"review:manage",
|
||||
"chat:use",
|
||||
],
|
||||
},
|
||||
auditor: {
|
||||
name: "Auditor",
|
||||
permissions: [
|
||||
"asset:read",
|
||||
"bia:read",
|
||||
"risk:read",
|
||||
"soa:read",
|
||||
"measure:read",
|
||||
"policy:read",
|
||||
"audit:read",
|
||||
"audit:conduct",
|
||||
"supplier:read",
|
||||
"evidence:read",
|
||||
"report:read",
|
||||
],
|
||||
},
|
||||
owner: {
|
||||
name: "Asset-/Risk-Owner",
|
||||
permissions: [
|
||||
"asset:read",
|
||||
"asset:write",
|
||||
"bia:read",
|
||||
"risk:read",
|
||||
"risk:write",
|
||||
"measure:read",
|
||||
"measure:write",
|
||||
"policy:read",
|
||||
"incident:report",
|
||||
"evidence:read",
|
||||
"evidence:write",
|
||||
"chat:use",
|
||||
],
|
||||
},
|
||||
user: {
|
||||
name: "Mitarbeiter",
|
||||
permissions: ["policy:read", "incident:report", "measure:read", "chat:use"],
|
||||
},
|
||||
};
|
||||
|
||||
export class ForbiddenError extends Error {
|
||||
constructor(permission: Permission) {
|
||||
super(`Fehlende Berechtigung: ${permission}`);
|
||||
this.name = "ForbiddenError";
|
||||
}
|
||||
}
|
||||
|
||||
/** Server-side permission check — UI hiding is convenience, this is security. */
|
||||
export function requirePermission(
|
||||
session: { user?: { permissions?: string[] } } | null,
|
||||
permission: Permission
|
||||
): void {
|
||||
if (!session?.user?.permissions?.includes(permission)) {
|
||||
throw new ForbiddenError(permission);
|
||||
}
|
||||
}
|
||||
|
||||
export function hasPermission(
|
||||
session: { user?: { permissions?: string[] } } | null,
|
||||
permission: Permission
|
||||
): boolean {
|
||||
return session?.user?.permissions?.includes(permission) ?? false;
|
||||
}
|
||||
Vendored
+35
@@ -0,0 +1,35 @@
|
||||
import type { DefaultSession } from "next-auth";
|
||||
|
||||
declare module "next-auth" {
|
||||
interface Session {
|
||||
user: {
|
||||
id: string;
|
||||
tenantId: string;
|
||||
tenantSlug: string;
|
||||
roles: string[];
|
||||
permissions: string[];
|
||||
isPlatformAdmin: boolean;
|
||||
} & DefaultSession["user"];
|
||||
}
|
||||
|
||||
interface User {
|
||||
id?: string;
|
||||
tenantId: string;
|
||||
tenantSlug: string;
|
||||
roles: string[];
|
||||
permissions: string[];
|
||||
isPlatformAdmin: boolean;
|
||||
}
|
||||
}
|
||||
|
||||
// next-auth/jwt re-exportiert nur aus @auth/core/jwt — Augmentation muss dorthin
|
||||
declare module "@auth/core/jwt" {
|
||||
interface JWT {
|
||||
userId: string;
|
||||
tenantId: string;
|
||||
tenantSlug: string;
|
||||
roles: string[];
|
||||
permissions: string[];
|
||||
isPlatformAdmin: boolean;
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user