1dcdba04a6
Allows for the creation of user accounts. A few notes on the specifics: - Experiments are the main access control objects. If you can view an experiment, you can view all its prompts/scenarios/evals. If you can edit it, you can edit or delete all of those as well. - Experiments are owned by Organizations in the database. Organizations can have multiple members and members can have roles of ADMIN, MEMBER or VIEWER. - Organizations can either be "personal" or general. Each user has a "personal" organization created as soon as they try to create an experiment. There's currently no UI support for creating general orgs or adding users to them; they're just in the database to future-proof all the ACL logic. - You can require that a user is signed-in to see a route using the `protectedProcedure` helper. When you use `protectedProcedure`, you also have to call `ctx.markAccessControlRun()` (or delegate to a function that does it for you; see accessControl.ts). This is to remind us to actually check for access control when we define a new endpoint.
50 lines
1.4 KiB
TypeScript
50 lines
1.4 KiB
TypeScript
import { OrganizationUserRole } from "@prisma/client";
|
|
import { TRPCError } from "@trpc/server";
|
|
import { type TRPCContext } from "~/server/api/trpc";
|
|
import { prisma } from "~/server/db";
|
|
|
|
// No-op method for protected routes that really should be accessible to anyone.
|
|
export const requireNothing = (ctx: TRPCContext) => {
|
|
ctx.markAccessControlRun();
|
|
};
|
|
|
|
export const requireCanViewExperiment = async (experimentId: string, ctx: TRPCContext) => {
|
|
await prisma.experiment.findFirst({
|
|
where: { id: experimentId },
|
|
});
|
|
|
|
// Right now all experiments are publicly viewable, so this is a no-op.
|
|
ctx.markAccessControlRun();
|
|
};
|
|
|
|
export const canModifyExperiment = async (experimentId: string, userId: string) => {
|
|
const experiment = await prisma.experiment.findFirst({
|
|
where: {
|
|
id: experimentId,
|
|
organization: {
|
|
OrganizationUser: {
|
|
some: {
|
|
role: { in: [OrganizationUserRole.ADMIN, OrganizationUserRole.MEMBER] },
|
|
userId,
|
|
},
|
|
},
|
|
},
|
|
},
|
|
});
|
|
|
|
return !!experiment;
|
|
};
|
|
|
|
export const requireCanModifyExperiment = async (experimentId: string, ctx: TRPCContext) => {
|
|
const userId = ctx.session?.user.id;
|
|
if (!userId) {
|
|
throw new TRPCError({ code: "UNAUTHORIZED" });
|
|
}
|
|
|
|
if (!(await canModifyExperiment(experimentId, userId))) {
|
|
throw new TRPCError({ code: "UNAUTHORIZED" });
|
|
}
|
|
|
|
ctx.markAccessControlRun();
|
|
};
|