1dcdba04a6
Allows for the creation of user accounts. A few notes on the specifics: - Experiments are the main access control objects. If you can view an experiment, you can view all its prompts/scenarios/evals. If you can edit it, you can edit or delete all of those as well. - Experiments are owned by Organizations in the database. Organizations can have multiple members and members can have roles of ADMIN, MEMBER or VIEWER. - Organizations can either be "personal" or general. Each user has a "personal" organization created as soon as they try to create an experiment. There's currently no UI support for creating general orgs or adding users to them; they're just in the database to future-proof all the ACL logic. - You can require that a user is signed-in to see a route using the `protectedProcedure` helper. When you use `protectedProcedure`, you also have to call `ctx.markAccessControlRun()` (or delegate to a function that does it for you; see accessControl.ts). This is to remind us to actually check for access control when we define a new endpoint.
50 lines
1.5 KiB
TypeScript
50 lines
1.5 KiB
TypeScript
import { z } from "zod";
|
|
import { createTRPCRouter, protectedProcedure, publicProcedure } from "~/server/api/trpc";
|
|
import { prisma } from "~/server/db";
|
|
import { requireCanModifyExperiment, requireCanViewExperiment } from "~/utils/accessControl";
|
|
|
|
export const templateVarsRouter = createTRPCRouter({
|
|
create: protectedProcedure
|
|
.input(z.object({ experimentId: z.string(), label: z.string() }))
|
|
.mutation(async ({ input, ctx }) => {
|
|
await requireCanModifyExperiment(input.experimentId, ctx);
|
|
|
|
await prisma.templateVariable.create({
|
|
data: {
|
|
experimentId: input.experimentId,
|
|
label: input.label,
|
|
},
|
|
});
|
|
}),
|
|
|
|
delete: protectedProcedure
|
|
.input(z.object({ id: z.string() }))
|
|
.mutation(async ({ input, ctx }) => {
|
|
const { experimentId } = await prisma.templateVariable.findUniqueOrThrow({
|
|
where: { id: input.id },
|
|
});
|
|
|
|
await requireCanModifyExperiment(experimentId, ctx);
|
|
|
|
await prisma.templateVariable.delete({ where: { id: input.id } });
|
|
}),
|
|
|
|
list: publicProcedure
|
|
.input(z.object({ experimentId: z.string() }))
|
|
.query(async ({ input, ctx }) => {
|
|
await requireCanViewExperiment(input.experimentId, ctx);
|
|
return await prisma.templateVariable.findMany({
|
|
where: {
|
|
experimentId: input.experimentId,
|
|
},
|
|
orderBy: {
|
|
createdAt: "asc",
|
|
},
|
|
select: {
|
|
id: true,
|
|
label: true,
|
|
},
|
|
});
|
|
}),
|
|
});
|