Janady13/missionmatch / internal/platform/security/sensitivity.go

1package security 2 3// FIELD SENSITIVITY, the access question the capability matrix cannot answer. 4// 5// A capability answers "may this person open the candidates page". It cannot answer "may this person see the 6// bill rate ON that page", because the answer differs per customer: a boutique firm where the owner recruits 7// wants everyone to see pay data, and a hundred seat agency running competing desks absolutely does not. So 8// the capability matrix stays fixed and correct, and this adds a second, per organization axis on top of it. 9// 10// THE TWO AXES BOTH HAVE TO PASS. A viewer with contact_visibility set to organization still cannot see a 11// candidate they have no capability to read. Sensitivity NARROWS, it never widens: no setting here grants 12// anything the capability matrix withheld, which is why an organization can safely be handed this control. 13// 14// THIS FILE IS PURE. No database, no context, no clock. Same inputs, same answer, every time, and it is unit 15// tested without a server, which is what the engineering rules ask of the parts that decide who sees what. 16 17// Sensitivity is how far a class of field travels inside an organization. The order is deliberate and the 18// zero value is the most restrictive, so a field whose sensitivity was never configured is hidden rather than 19// exposed. A missing setting must never read as permission. 20type Sensitivity string 21 22const ( 23 // SensitivityOwner is the owner alone. Used by default for margin, which is the number that tells anyone 24 // holding it exactly what the agency makes on a placement. 25 SensitivityOwner Sensitivity = "owner" 26 // SensitivityManagers is the owner, admins and managers: the people accountable for a book of business. 27 // This is the industry default for pay data and the default for rates here. 28 SensitivityManagers Sensitivity = "managers" 29 // SensitivityTeam is everyone who does the work, which is managers plus recruiters. It excludes viewers 30 // and members, the two roles that exist to look at outcomes rather than to run a desk. 31 SensitivityTeam Sensitivity = "team" 32 // SensitivityOrganization is everyone with a login who can already read the record. 33 SensitivityOrganization Sensitivity = "organization" 34) 35 36// ValidSensitivity reports whether s is one of the four levels. Used at the settings boundary so an unknown 37// string is refused on the way in rather than silently treated as restrictive on the way out. 38func ValidSensitivity(s Sensitivity) bool { 39 switch s { 40 case SensitivityOwner, SensitivityManagers, SensitivityTeam, SensitivityOrganization: 41 return true 42 } 43 return false 44} 45 46// sensitivityFloor is the LOWEST role rank that satisfies each level, read against the same roleRank ladder 47// the capability matrix uses. Expressing it as a floor on the existing ladder rather than as its own role 48// list means a role added to this system later cannot silently fall outside field sensitivity: it lands at a 49// rank, and the rank decides. 50var sensitivityFloor = map[Sensitivity]int{ 51 SensitivityOwner: roleRank[RoleOwner], 52 SensitivityManagers: roleRank[RoleManager], 53 SensitivityTeam: roleRank[RoleRecruiter], 54 SensitivityOrganization: roleRank[RoleViewer], 55} 56 57// CanSeeField reports whether role may see a field classified at level s. 58// 59// An UNRECOGNISED level denies. That is the whole design in one line: the failure mode of a typo, a partially 60// applied migration, or a value from a newer version of this software is that a rate stops being visible, not 61// that it starts being visible to everyone. 62func CanSeeField(role Role, s Sensitivity) bool { 63 floor, ok := sensitivityFloor[s] 64 if !ok { 65 return false 66 } 67 rank, ok := roleRank[role] 68 if !ok { 69 return false 70 } 71 return rank >= floor 72} 73 74// WorkVisibility is how far one person's activity travels: whether a colleague can see that somebody is 75// already working a candidate. It is the double work control, and it is separate from field sensitivity 76// because it governs a different thing, a person's activity rather than a record's contents. 77type WorkVisibility string 78 79const ( 80 // VisibilityPrivate means activity is visible only to its owner and to management. Chosen by firms whose 81 // recruiters compete on the same bench and who consider a desk's pipeline confidential. 82 VisibilityPrivate WorkVisibility = "private" 83 // VisibilityTeam means the people who run desks see each other's activity; viewers and members do not. 84 VisibilityTeam WorkVisibility = "team" 85 // VisibilityOrganization means anyone who can read the record can see who is on it. This is the DEFAULT, 86 // because preventing two recruiters from calling the same candidate on the same day is the entire reason 87 // the feature exists, and a default of private would ship the feature switched off. 88 VisibilityOrganization WorkVisibility = "organization" 89) 90 91// ValidWorkVisibility reports whether v is one of the three levels. 92func ValidWorkVisibility(v WorkVisibility) bool { 93 switch v { 94 case VisibilityPrivate, VisibilityTeam, VisibilityOrganization: 95 return true 96 } 97 return false 98} 99 100// CanSeeOthersWork reports whether viewer, holding role, may see that another person is working a record. 101// 102// Management always sees it, at every level including private. That is not a loophole, it is the point of the 103// setting: private means recruiters do not watch each other, never that a manager cannot see their own team's 104// pipeline. A manager who cannot see who is working what cannot run a desk, and an agency that bought this to 105// stop double work would have bought a control that hides the collision from the only person able to fix it. 106func CanSeeOthersWork(role Role, v WorkVisibility) bool { 107 rank, ok := roleRank[role] 108 if !ok { 109 return false 110 } 111 if rank >= roleRank[RoleManager] { 112 return true 113 } 114 switch v { 115 case VisibilityOrganization: 116 return true 117 case VisibilityTeam: 118 return rank >= roleRank[RoleRecruiter] 119 case VisibilityPrivate: 120 return false 121 default: 122 // Same fail closed rule as CanSeeField. An unrecognised value hides activity rather than revealing it. 123 return false 124 } 125} 126