(workspace: Workspace)
| 1 | import type { AuthorizationCheck, Workspace } from "#/api/typesGenerated"; |
| 2 | |
| 3 | export const workspaceChecks = (workspace: Workspace) => |
| 4 | ({ |
| 5 | readWorkspace: { |
| 6 | object: { |
| 7 | resource_type: "workspace", |
| 8 | resource_id: workspace.id, |
| 9 | owner_id: workspace.owner_id, |
| 10 | }, |
| 11 | action: "read", |
| 12 | }, |
| 13 | shareWorkspace: { |
| 14 | object: { |
| 15 | resource_type: "workspace", |
| 16 | resource_id: workspace.id, |
| 17 | owner_id: workspace.owner_id, |
| 18 | }, |
| 19 | action: "share", |
| 20 | }, |
| 21 | updateWorkspace: { |
| 22 | object: { |
| 23 | resource_type: "workspace", |
| 24 | resource_id: workspace.id, |
| 25 | owner_id: workspace.owner_id, |
| 26 | }, |
| 27 | action: "update", |
| 28 | }, |
| 29 | updateWorkspaceVersion: { |
| 30 | object: { |
| 31 | resource_type: "template", |
| 32 | resource_id: workspace.template_id, |
| 33 | }, |
| 34 | action: "update", |
| 35 | }, |
| 36 | // We only want to allow template admins to delete failed workspaces since |
| 37 | // they can leave orphaned resources. |
| 38 | deleteFailedWorkspace: { |
| 39 | object: { |
| 40 | resource_type: "template", |
| 41 | resource_id: workspace.template_id, |
| 42 | }, |
| 43 | action: "update", |
| 44 | }, |
| 45 | }) satisfies Record<string, AuthorizationCheck>; |
| 46 | |
| 47 | export type WorkspacePermissions = Record< |
| 48 | keyof ReturnType<typeof workspaceChecks>, |
no outgoing calls
no test coverage detected