app/lab/titles.mjs

Functions

Imports

It imports no other module of this repo. Imported by app/lab/access-sync.server.ts, app/lab/actor.server.ts, app/lab/inventory.server.ts, app/lab/members.server.ts, app/lab/runs.server.ts, app/routes/workspace._index.tsx, app/routes/workspace.inventory.lot.tsx, app/routes/workspace.inventory.tsx, app/routes/workspace.runs.run.tsx, app/routes/workspace.runs.tsx, app/routes/workspace.tsx.

Source

1/**
2 * The /lab workspace's titles and what each may do (capsid docs/design/design-identity-roles.md, "Layers and
3 * permissions"; docs/KNOWLEDGE-BASE.md step 5). The rules every app shares are site-runtime's `./members`; this file
4 * is only the lab's own list. Code asks `can(actor, PERMISSION)`, never which title a person holds, so a title can be
5 * renamed or split without touching a check.
6 *
7 * The Primary Owner (layer 0, PRIMARY_OWNER_EMAIL) and an Owner (layer 1) hold every permission below; `defineTitles`
8 * adds both and they cannot be redefined. Publishing stays in /admin, which is the Primary Owner's alone.
9 */
10
11import { defineTitles } from "@dustinedwards/site-runtime/members";
12
13export const PERMISSION = Object.freeze({
14  /** Inventory, lots and protocols, private fields included. */
15  read: "read",
16  /** Mark a lot opened, used or empty. */
17  useLot: "use_lot",
18  /** Record a run, and see your own. */
19  recordRun: "record_run",
20  readAllRuns: "read_all_runs",
21  /** Items, lots and locations. */
22  editInventory: "edit_inventory",
23  /** A protocol draft; only the Primary Owner publishes. */
24  draftProcedure: "draft_procedure",
25  /** Add, renew, change and remove people below your own layer. */
26  manageMembers: "manage_members",
27});
28
29const P = PERMISSION;
30
31export const LAB_CATALOG = defineTitles({
32  permissions: Object.values(P),
33  titles: [
34    {
35      id: "lab_manager",
36      label: "Lab manager",
37      layer: 2,
38      expires: true,
39      permissions: [P.read, P.useLot, P.recordRun, P.readAllRuns, P.editInventory, P.draftProcedure, P.manageMembers],
40    },
41    { id: "lab_worker", label: "Lab worker", layer: 3, expires: true, permissions: [P.read, P.useLot, P.recordRun] },
42  ],
43});
44
45/** The words a person reads for a title id; an unknown id is shown as itself. @param {string} id */
46export function titleLabel(id) {
47  return LAB_CATALOG.titles.get(id)?.label ?? id;
48}
49
50/**
51 * Who may edit the semester end dates: the Primary Owner and Owners (layers 0 and 1), as the ruling says. A layer
52 * question and not a permission one, because no title below an Owner may ever hold it.
53 * @param {{ layer: number } | null} actor
54 */
55export function canEditTerms(actor) {
56  return !!actor && actor.layer <= 1;
57}