refactor(auth): unify pbac logic and remove hasAdminAccess

apps/web/src/lib/auth/utils.ts

@@ -1,28 +1,24 @@
 
+
 /**
- * Checks if a user has sufficient permissions to access the admin area.
- * 
- * Rules:
- * 1. Default: user.permissions includes '*' (Super Admin).
- * 2. System Level: user.permissions includes 'tenants:manage', 'tenants:read', or 'users:manage'.
- * 3. Namespace: user.permissions starts with 'system_' or 'admin:'.
- * 
- * @param permissions List of permission strings.
- * @returns boolean
+ * Checks if a user has a specific permission.
+ * Supports:
+ * 1. Root Wildcard ('*')
+ * 2. Exact Match ('resource:action')
+ * 3. Resource Wildcard ('resource:*')
+ * 4. Action Wildcard ('*:action')
  */
-export function hasAdminAccess(permissions?: string[]): boolean {
+export function hasPermission(permissions: string[] | undefined, resource: string, action: string): boolean {
     if (!permissions || permissions.length === 0) return false;
 
-    // Super Admin
-    if (permissions.includes('*')) return true;
-
-    // Explicit System Permissions
-    const systemPermissions = ['tenants:manage', 'tenants:read', 'users:manage'];
-    if (permissions.some(p => systemPermissions.includes(p))) return true;
+    const requiredPermission = `${resource}:${action}`;
+    const resourceWildcard = `${resource}:*`;
+    const actionWildcard = `*:${action}`;
 
-    // Check for Namespaced System Permissions (e.g. system_users:read, admin:dashboard)
-    // We check the resource part of the permission string "resource:action" (or just verify prefix)
-    return permissions.some(p => {
-        return p.startsWith('system_') || p.startsWith('admin:');
-    });
+    return permissions.some(p =>
+        p === '*' ||                 // 1. Super Admin
+        p === requiredPermission ||  // 2. Exact Match
+        p === resourceWildcard ||  // 3. Resource Wildcard
+        p === actionWildcard         // 4. Action Wildcard
+    );
 }

apps/web/src/pages/auth/LoginPage.tsx

@@ -2,7 +2,7 @@ import { useState, useEffect } from 'react';
 import { useNavigate } from 'react-router-dom';
 import { useAuth } from '../../hooks/useAuth';
 import { authClient } from '../../lib/auth-client';
-import { hasAdminAccess } from '../../lib/auth/utils';
+import { hasPermission } from '../../lib/auth/utils';
 import { Button } from '@/components/ui/button';
 import { Input } from '@/components/ui/input';
 import { Card, CardContent, CardHeader, CardTitle, CardDescription } from '@/components/ui/card';
@@ -26,8 +26,8 @@ export function LoginPage() {
     useEffect(() => {
         if (user && !isLoading) {
             // Permission-based redirect
-            // If user can manage tenants or users (system level), they belong in the admin dashboard.
-            const target = hasAdminAccess(user.permissions) ? '/admin' : '/dashboard';
+            // If user can view the dashboard (admin level), they belong in the admin dashboard.
+            const target = hasPermission(user.permissions, 'dashboard', 'view') ? '/admin' : '/dashboard';
             navigate(target);
         }
     }, [user, navigate, isLoading]);

apps/web/src/pages/auth/SignupPage.tsx

@@ -1,7 +1,7 @@
 import { useState, useEffect } from 'react';
 import { useNavigate, useSearchParams, Link } from 'react-router-dom';
 import { useAuth } from '../../hooks/useAuth';
-import { hasAdminAccess } from '../../lib/auth/utils';
+import { hasPermission } from '../../lib/auth/utils';
 import { Button } from '@/components/ui/button';
 import { Input } from '@/components/ui/input';
 import { Card, CardContent, CardHeader, CardTitle, CardDescription } from '@/components/ui/card';
@@ -94,7 +94,7 @@ export function SignupPage() {
                     // Note: ensure your sessions endpoint returns permissions
                     const user = sessionData.user as { permissions?: string[] };
 
-                    if (hasAdminAccess(user.permissions)) {
+                    if (hasPermission(user.permissions, 'dashboard', 'view')) {
                         navigate('/admin');
                     } else {
                         navigate('/dashboard');

apps/web/src/providers/access-control-provider.ts

@@ -1,79 +1,51 @@
 import type { AccessControlProvider, CanParams, CanReturnType } from "@refinedev/core";
 import { authProvider } from "./auth-provider";
+import { hasPermission } from "../lib/auth/utils";
+
+// Resource Normalization Map
+// Strip 'admin/' prefix to map 'admin/users' -> 'users' automatically.
+const RESOURCE_MAP: Record<string, string> = {
+    // Keep distinct mappings if needed, otherwise normalization handles most
+    "admin/users": "users",
+    "admin/tenants": "tenants",
+};
+
+// Action Normalization Map
+// Map frontend actions to backend permissions
+const ACTION_MAP: Record<string, string> = {
+    "list": "read",
+    "show": "read",
+    "edit": "update",
+};
 
 export const accessControlProvider: AccessControlProvider = {
     can: async ({ resource, action }: CanParams): Promise<CanReturnType> => {
-        // Fetch permissions fresh (or cached by AuthProvider/Client)
-        // Note: authProvider.getPermissions is implemented now.
-        // We cast to string[] strictly.
         const permissions = (await authProvider.getPermissions?.()) as string[] ?? [];
 
-        // Admin Bypass (Optional: if 'platform_admin' role implies *, but our backend 
-        // sends '*' in permissions list for admins anyway).
-        if (permissions.includes("*")) {
-            return { can: true };
-        }
-
-        // Map Refine actions to our RBAC verbs
-        // Refine: list, show, create, edit, delete
-        // RBAC: read, manage (invite is specific)
-
-        let requiredAction = "manage"; // Default to high security
-        if (action === "list" || action === "show") {
-            requiredAction = "read";
-        }
-
-        // Handling special resource names if they differ from backend
-        // e.g. "admin/users" -> "system_users" (or "users")
-        // My AdminRoutes uses "admin/users".
-        // My Seed Script uses "system_users" and "users".
-        // Let's assume strict mapping or normalize.
-        // If resource is "admin/users", needed permission might be "system_users:read".
-
-        let targetResource = resource;
-
-        // Map frontend resources to backend resources
-        // Note: This mapping ensures Refine resources (like "admin/users") align with backend RBAC resources ("system_users").
-        // If you add new resources, update this map here.
-        // TODO: Move to external config or inject via context in the future for flexibility.
-        const resourceMap: Record<string, string> = {
-            "admin/users": "system_users",
-            "admin/tenants": "system_tenants",
-            "users": "users",
-            "tenants": "tenants",
-        };
+        // Resource Normalization
+        let targetResource = resource ?? "";
 
-        if (resource && resourceMap[resource]) {
-            targetResource = resourceMap[resource];
+        if (RESOURCE_MAP[targetResource]) {
+            targetResource = RESOURCE_MAP[targetResource];
+        } else if (targetResource.startsWith("admin/")) {
+            targetResource = targetResource.replace(/^admin\//, "");
         }
 
-        const requiredPermission = `${targetResource}:${requiredAction}`;
+        // Action Normalization
+        const rawAction = action || "manage";
+        const targetAction = ACTION_MAP[rawAction] || rawAction;
 
-        // Also allow if specific permission exists (e.g. system_users:invite)
-        // If action is custom, e.g. "invite", check "system_users:invite"
-        if (action !== "list" && action !== "show" && action !== "create" && action !== "edit" && action !== "delete") {
-            // Custom action (exact match)
-            if (permissions.includes(`${targetResource}:${action}`)) {
-                return { can: true };
-            }
-        }
-
-        // Standard Check
-        // Check exact match
-        if (permissions.includes(requiredPermission)) {
-            return { can: true };
-        }
+        // Use Shared Utility
+        // Matches strict logic: *, resource:action, resource:*, *:action
+        const canAccess = hasPermission(permissions, targetResource, targetAction);
 
-        // Check "manage" implies "read"? 
-        // Usually "manage" implies everything.
-        // If I require "read", but have "manage", I should typically allow.
-        if (requiredAction === "read" && permissions.includes(`${targetResource}:manage`)) {
+        if (canAccess) {
             return { can: true };
         }
 
         return {
             can: false,
-            reason: `Missing permission: ${requiredPermission}`,
+            reason: `Missing permission: ${targetResource}:${targetAction}`,
         };
     },
 };

packages/identity/src/adapters/drizzle-permission.adapter.ts

@@ -48,22 +48,24 @@ export class DrizzlePermissionAdapter implements IPermissionProvider {
   async getPermissions(user: User, tenantId?: string): Promise<string[]> {
     const perms: string[] = [];
 
+    // 1. Super Admin Wildcard
     if (user.systemRole === "platform_admin") {
       perms.push("*");
+      // Platform admins might implicitely have access to everything,
+      // but some frontend logic might rely on specific keys if they check `can('users', 'manage')`.
+      // The frontend wildcard check `has('*')` handles this.
     }
 
     if (tenantId) {
       const context = await this.fetchMemberContext(user.id, tenantId);
 
       if (context) {
-        // Owner override: return * or all permissions?
-        // Implicitly Owner has all, but for granular checks we might want to wildcard it
-        // or return a special "owner" permission?
-        // For now, let's return the explicit permissions formatted as "resource:action"
+        // 2. Owner Wildcard
         if (context.roleName === "Owner") {
           perms.push("*");
         }
 
+        // 3. Explicit Permissions
         context.permissions.forEach((p) => {
           perms.push(`${p.resource}:${p.action}`);
         });

packages/identity/src/scripts/seed-rbac.ts

@@ -6,12 +6,28 @@ export const seedRbac = async (db: NodePgDatabase<typeof schema>) => {
 
   // 1. Define Standard Permissions
   // resource:action
+  // Strictly granular for PBAC strategies
   const standardPerms = [
-    { id: "users:manage", action: "manage", resource: "users" },
+    // Users
     { id: "users:read", action: "read", resource: "users" },
-    { id: "tenants:manage", action: "manage", resource: "tenants" },
+    { id: "users:create", action: "create", resource: "users" },
+    { id: "users:update", action: "update", resource: "users" },
+    { id: "users:delete", action: "delete", resource: "users" },
+    { id: "users:manage", action: "manage", resource: "users" },
+
+    // Tenants
     { id: "tenants:read", action: "read", resource: "tenants" },
+    { id: "tenants:create", action: "create", resource: "tenants" },
+    { id: "tenants:update", action: "update", resource: "tenants" },
+    { id: "tenants:delete", action: "delete", resource: "tenants" },
+    { id: "tenants:manage", action: "manage", resource: "tenants" },
+
+    // Dashboard
+    { id: "dashboard:read", action: "read", resource: "dashboard" },
+
+    // Settings
     { id: "settings:manage", action: "manage", resource: "settings" },
+    { id: "settings:read", action: "read", resource: "settings" },
   ];
 
   await db
@@ -42,13 +58,31 @@ export const seedRbac = async (db: NodePgDatabase<typeof schema>) => {
   // Map role -> permission[]
   const roleMap: Record<string, string[]> = {
     owner: [
+      "dashboard:read",
       "users:manage",
       "users:read",
+      "users:create",
+      "users:update",
+      "users:delete",
       "tenants:manage",
       "tenants:read",
+      "tenants:create",
+      "tenants:update",
+      "tenants:delete",
+      "settings:manage",
+      "settings:read",
+    ],
+    admin: [
+      "dashboard:read",
+      "users:manage",
+      "users:read",
+      "users:create",
+      "users:update",
+      "users:delete",
+      "tenants:read",
       "settings:manage",
+      "settings:read",
     ],
-    admin: ["users:manage", "users:read", "tenants:read", "settings:manage"],
     member: ["users:read", "tenants:read"],
   };