Janady13/missionmatch / internal/platform/security/rbac.go

1package security 2 3// Role is the tenant role enum already enforced by the users table CHECK constraint. The five roles 4// form an ordered hierarchy for the RequireRole comparison, but capabilities are assigned explicitly 5// per role below, not implied by rank alone. 6type Role string 7 8const ( 9 RoleOwner Role = "owner" 10 RoleAdmin Role = "admin" 11 RoleRecruiter Role = "recruiter" 12 RoleMember Role = "member" 13 RoleViewer Role = "viewer" 14) 15 16// Capability is a fine grained permission checked at the API. Handlers gate on a Capability rather 17// than a role so the policy lives in one table and the UI never has to hide a control to enforce 18// access. 19type Capability string 20 21const ( 22 CapCandidateRead Capability = "candidate.read" 23 CapCandidateWrite Capability = "candidate.write" 24 CapRequirementEdit Capability = "requirement.write" 25 CapSlateEdit Capability = "slate.write" 26 CapSearchRun Capability = "search.run" 27 CapExportRun Capability = "export.run" 28 CapSourcingRead Capability = "sourcing.read" // see sourced candidate contact fields and the sourcing log 29 CapPrivacyErase Capability = "privacy.erase" // hard delete a sourced candidate and their PII 30 CapUserInvite Capability = "user.invite" 31 CapUserRoleChange Capability = "user.role.change" 32 CapUserDisable Capability = "user.disable" 33 CapOrgSettings Capability = "org.settings.write" 34 CapAuditRead Capability = "audit.read" 35 CapComplianceRead Capability = "compliance.read" // adverse impact report, AEDT inventory and model registry, retention reads 36 CapComplianceWrite Capability = "compliance.write" // register an AEDT tool, run retention: governance writes 37 CapStaffingRecommend Capability = "staffing.recommend" // generate an AI staffing recommendation run; this WRITES recommendation rows, so it is a write capability, not a read 38) 39 40// roleRank orders the hierarchy for AtLeast and for bounding invited roles. Higher is more 41// privileged. 42var roleRank = map[Role]int{ 43 RoleViewer: 0, 44 RoleMember: 1, 45 RoleRecruiter: 2, 46 RoleAdmin: 3, 47 RoleOwner: 4, 48} 49 50// capabilityRoles is the authoritative permission matrix. owner holds every capability. admin manages 51// recruiter, member, and viewer accounts and runs the recruiting workflow, but cannot change org 52// settings or manage other admins and owners (those are owner only and are further guarded by the 53// separation of duties checks in the auth service). The two privacy capabilities gate the sourced 54// candidate contact fields, the sourcing log, and erasure: sourcing.read goes to the roles that 55// actually source (owner, admin, recruiter) and the destructive privacy.erase is held tighter 56// (owner, admin). 57var capabilityRoles = map[Capability][]Role{ 58 CapCandidateRead: {RoleOwner, RoleAdmin, RoleRecruiter, RoleMember, RoleViewer}, 59 CapSearchRun: {RoleOwner, RoleAdmin, RoleRecruiter, RoleMember, RoleViewer}, 60 CapCandidateWrite: {RoleOwner, RoleAdmin, RoleRecruiter}, 61 CapRequirementEdit: {RoleOwner, RoleAdmin, RoleRecruiter}, 62 CapSlateEdit: {RoleOwner, RoleAdmin, RoleRecruiter}, 63 CapStaffingRecommend: {RoleOwner, RoleAdmin, RoleRecruiter}, // same roles that hold slate.write: generating staffing recommendations is the same authority tier 64 CapExportRun: {RoleOwner, RoleAdmin, RoleRecruiter}, 65 CapSourcingRead: {RoleOwner, RoleAdmin, RoleRecruiter}, 66 CapPrivacyErase: {RoleOwner, RoleAdmin}, 67 CapUserInvite: {RoleOwner, RoleAdmin}, 68 CapUserRoleChange: {RoleOwner, RoleAdmin}, 69 CapUserDisable: {RoleOwner, RoleAdmin}, 70 CapAuditRead: {RoleOwner, RoleAdmin}, 71 CapComplianceRead: {RoleOwner, RoleAdmin}, 72 CapComplianceWrite: {RoleOwner, RoleAdmin}, 73 CapOrgSettings: {RoleOwner}, 74} 75 76// capabilitySet is the matrix indexed for O(1) lookup, built once at init. 77var capabilitySet = func() map[Role]map[Capability]bool { 78 set := map[Role]map[Capability]bool{ 79 RoleOwner: {}, RoleAdmin: {}, RoleRecruiter: {}, RoleMember: {}, RoleViewer: {}, 80 } 81 for cap, roles := range capabilityRoles { 82 for _, role := range roles { 83 set[role][cap] = true 84 } 85 } 86 return set 87}() 88 89// ValidRole reports whether role is one of the five known roles. 90func ValidRole(role Role) bool { 91 _, ok := roleRank[role] 92 return ok 93} 94 95// Has reports whether role holds the capability. 96func Has(role Role, cap Capability) bool { 97 caps, ok := capabilitySet[role] 98 if !ok { 99 return false 100 } 101 return caps[cap] 102} 103 104// AtLeast reports whether role is at or above min in the hierarchy. Unknown roles are never at least 105// anything. 106func AtLeast(role, min Role) bool { 107 r, ok := roleRank[role] 108 if !ok { 109 return false 110 } 111 m, ok := roleRank[min] 112 if !ok { 113 return false 114 } 115 return r >= m 116} 117 118// OutRanks reports whether actor is strictly more privileged than other. It is the core separation of 119// duties predicate: a user may only invite, role change, disable, or reset the MFA of someone they 120// outrank, never a peer or a superior, and never themselves. 121func OutRanks(actor, other Role) bool { 122 a, ok := roleRank[actor] 123 if !ok { 124 return false 125 } 126 o, ok := roleRank[other] 127 if !ok { 128 return false 129 } 130 return a > o 131} 132 133// CanInvite reports whether an actor may invite a user with the given role. The invited role must be 134// strictly below the actor's own role, so an admin can invite recruiter, member, and viewer but 135// never another admin or an owner, and owners are created only through provisioning, never an invite. 136func CanInvite(actor, invited Role) bool { return OutRanks(actor, invited) } 137