438 lines
15 KiB
TypeScript
438 lines
15 KiB
TypeScript
import React, { useMemo } from 'react';
|
|
import { Navigate } from 'react-router-dom';
|
|
import { useAuth } from './AuthProvider';
|
|
|
|
export type RoleClaim =
|
|
| 'dashboard'
|
|
| 'governance'
|
|
| 'projects_milestones'
|
|
| 'grant_financials'
|
|
| 'evidence_risks'
|
|
| 'beneficiaries'
|
|
| 'change_management'
|
|
| 'site_visits'
|
|
| 'compliance'
|
|
| 'settings_invites'
|
|
| 'settings_users'
|
|
| 'settings_auditlog'
|
|
| 'settings_notifications'
|
|
| 'tenant_self_service'
|
|
| 'tenant_management'
|
|
| 'unrestricted';
|
|
|
|
export type ClaimAction = 'view' | 'add' | 'update' | 'export' | 'all';
|
|
|
|
export interface RoleClaimDefinition {
|
|
claim: RoleClaim;
|
|
label: string;
|
|
description: string;
|
|
}
|
|
|
|
export const ROLE_CLAIM_DEFINITIONS: RoleClaimDefinition[] = [
|
|
{ claim: 'dashboard', label: 'Executive Dashboard', description: 'Strategic macro metrics and ISO 31000 portfolio health' },
|
|
{ claim: 'governance', label: 'Governance & Structure', description: 'Holding entities, investment portfolios, and statutory programmes' },
|
|
{ claim: 'projects_milestones', label: 'Projects & Milestones', description: 'Work breakdown structure, scheduled milestones, and progress' },
|
|
{ claim: 'grant_financials', label: 'Grant & Financials', description: 'Funding awards, budget line allocations, and disbursements' },
|
|
{ claim: 'evidence_risks', label: 'M&E, Evidence & Risks', description: 'Evidence verification queue and ISO 31000 risk registers' },
|
|
{ claim: 'beneficiaries', label: 'Beneficiaries', description: 'Target demographics, compliance tracking, and outcomes' },
|
|
{ claim: 'change_management', label: 'Change Management', description: 'Contractual change requests, issues, and enactments' },
|
|
{ claim: 'site_visits', label: 'Site Visits', description: 'Physical field inspection reports and inspector findings' },
|
|
{ claim: 'compliance', label: 'Compliance', description: 'Statutory compliance dashboard, outcome fulfillment, and risk monitoring' },
|
|
{ claim: 'settings_invites', label: 'Settings Invites', description: 'Statutory onboarding invitations and applicant notifications' },
|
|
{ claim: 'settings_users', label: 'Settings Users', description: 'Direct user account administration and role memberships' },
|
|
{ claim: 'settings_auditlog', label: 'Settings Audit Log', description: 'System-wide activity ledger and telemetry records' },
|
|
{ claim: 'settings_notifications', label: 'Settings Notifications', description: 'SMTP engines, notification dispatch, and gateways' },
|
|
{ claim: 'tenant_self_service', label: 'Tenant Self-Service', description: 'Tenant configuration parameters and self-managed sub-users' },
|
|
{ claim: 'tenant_management', label: 'Tenant Management', description: 'Multi-tenant partition directory and cross-tenant isolation' },
|
|
{ claim: 'unrestricted', label: 'Unrestricted Access', description: 'Full system-wide administrative control' },
|
|
];
|
|
|
|
export const CLAIM_ACTION_OPTIONS: { action: ClaimAction; label: string; description: string }[] = [
|
|
{ action: 'view', label: 'view', description: 'Can view records based on role' },
|
|
{ action: 'add', label: 'add', description: 'Can create records or give feedback; change non-approve statuses' },
|
|
{ action: 'update', label: 'update', description: 'Can use approve status change in dropdowns' },
|
|
{ action: 'export', label: 'export', description: 'Can click export buttons (Spreadsheet/PDF)' },
|
|
{ action: 'all', label: 'all', description: 'Can do everything' },
|
|
];
|
|
|
|
/**
|
|
* Base Role to Claims mapping according to PFM RBAC Specification.
|
|
*/
|
|
export const ROLE_CLAIM_MAP: Record<string, RoleClaim[]> = {
|
|
admin: ['unrestricted'],
|
|
executive: [
|
|
'dashboard',
|
|
'compliance',
|
|
'governance',
|
|
'projects_milestones',
|
|
'grant_financials',
|
|
'evidence_risks',
|
|
'tenant_self_service',
|
|
],
|
|
supervisor: [
|
|
'dashboard',
|
|
'compliance',
|
|
'projects_milestones',
|
|
'grant_financials',
|
|
'evidence_risks',
|
|
'beneficiaries',
|
|
'change_management',
|
|
'site_visits',
|
|
'settings_invites',
|
|
'settings_users',
|
|
],
|
|
manager: [
|
|
'dashboard',
|
|
'compliance',
|
|
'projects_milestones',
|
|
'grant_financials',
|
|
'evidence_risks',
|
|
'beneficiaries',
|
|
'change_management',
|
|
'site_visits',
|
|
'settings_invites',
|
|
'settings_users',
|
|
'settings_auditlog',
|
|
'settings_notifications',
|
|
'tenant_self_service',
|
|
],
|
|
contributor: [
|
|
'projects_milestones',
|
|
'grant_financials',
|
|
'evidence_risks',
|
|
'beneficiaries',
|
|
'change_management',
|
|
'site_visits',
|
|
'settings_invites',
|
|
],
|
|
};
|
|
|
|
/**
|
|
* Resolves action capability set given a claim value string.
|
|
* - view: can view records based on role
|
|
* - add: can add/create records or give feedback, change statuses other than approve (+ view)
|
|
* - update: can use approve status change in drop downs (+ view, + add)
|
|
* - export: can click export buttons (+ view)
|
|
* - all: can do everything
|
|
*/
|
|
export function resolveClaimActionSet(
|
|
claimValue: string | null | undefined,
|
|
roleName?: string
|
|
): Set<ClaimAction> {
|
|
const actions = new Set<ClaimAction>();
|
|
if (!claimValue && !roleName) return actions;
|
|
|
|
const rawVal = (claimValue || '').toLowerCase().trim();
|
|
const role = (roleName || '').toLowerCase().trim();
|
|
|
|
// Explicit claim assignment values
|
|
if (rawVal) {
|
|
if (rawVal === 'all' || rawVal === 'unrestricted' || rawVal === 'true' || rawVal === '1') {
|
|
actions.add('all');
|
|
actions.add('view');
|
|
actions.add('add');
|
|
actions.add('update');
|
|
actions.add('export');
|
|
return actions;
|
|
}
|
|
if (rawVal === 'none' || rawVal === 'restricted' || rawVal === 'false' || rawVal === '0') {
|
|
return actions;
|
|
}
|
|
|
|
const tokens = rawVal.split(',').map((t) => t.trim());
|
|
for (const val of tokens) {
|
|
if (val === 'all') {
|
|
actions.add('all');
|
|
actions.add('view');
|
|
actions.add('add');
|
|
actions.add('update');
|
|
actions.add('export');
|
|
} else if (val === 'view' || val === 'read') {
|
|
actions.add('view');
|
|
} else if (val === 'add' || val === 'edit' || val === 'write' || val === 'create') {
|
|
// 'add' encompasses create and non-approval edits
|
|
actions.add('view');
|
|
actions.add('add');
|
|
} else if (val === 'update' || val === 'approve' || val === 'verify') {
|
|
// 'update' strictly grants approval capability (+ view and add)
|
|
actions.add('view');
|
|
actions.add('add');
|
|
actions.add('update');
|
|
} else if (val === 'export') {
|
|
actions.add('view');
|
|
actions.add('export');
|
|
}
|
|
}
|
|
return actions;
|
|
}
|
|
|
|
// Default fallback by role if no overriding claim value specified
|
|
if (role === 'admin') {
|
|
actions.add('all');
|
|
actions.add('view');
|
|
actions.add('add');
|
|
actions.add('update');
|
|
actions.add('export');
|
|
} else if (role === 'executive' || role === 'manager') {
|
|
actions.add('all');
|
|
actions.add('view');
|
|
actions.add('add');
|
|
actions.add('update');
|
|
actions.add('export');
|
|
} else if (role === 'supervisor') {
|
|
// Supervisor performs operational review and verification/approval of milestones & evidence
|
|
actions.add('view');
|
|
actions.add('add');
|
|
actions.add('update');
|
|
actions.add('export');
|
|
} else if (role === 'contributor') {
|
|
// Contributor is strictly working-level execution: creating activities, submitting evidence, etc. (NO approve/update)
|
|
actions.add('view');
|
|
actions.add('add');
|
|
} else {
|
|
actions.add('view');
|
|
}
|
|
|
|
return actions;
|
|
}
|
|
|
|
/**
|
|
* Helper to extract explicit claim value from varied dictionary structures
|
|
*/
|
|
export function extractExplicitClaimValue(
|
|
claims: Record<string, any> = {},
|
|
claim: RoleClaim
|
|
): string | null {
|
|
if (!claims || typeof claims !== 'object') return null;
|
|
|
|
if (claims[claim] !== undefined && claims[claim] !== null) {
|
|
return String(claims[claim]).trim();
|
|
}
|
|
if (claims[`role_claim:${claim}`] !== undefined) {
|
|
return String(claims[`role_claim:${claim}`]).trim();
|
|
}
|
|
if (claims[`claim:${claim}`] !== undefined) {
|
|
return String(claims[`claim:${claim}`]).trim();
|
|
}
|
|
|
|
const noUnderscore = claim.replace(/_/g, '');
|
|
if (claims[noUnderscore] !== undefined) {
|
|
return String(claims[noUnderscore]).trim();
|
|
}
|
|
|
|
const arrayCandidates = [
|
|
claims.claims,
|
|
claims.UserClaims,
|
|
claims.user_claims,
|
|
claims.role_claims,
|
|
];
|
|
for (const arr of arrayCandidates) {
|
|
if (Array.isArray(arr)) {
|
|
for (const item of arr) {
|
|
if (typeof item === 'object' && item !== null) {
|
|
const type = (item.type || item.claimType || item.name || '').toLowerCase().trim();
|
|
if (type === claim || type === noUnderscore) {
|
|
return String(item.value || item.claimValue || 'all').trim();
|
|
}
|
|
} else if (typeof item === 'string') {
|
|
const [type, val] = item.split(':').map((s) => s.trim().toLowerCase());
|
|
if (type === claim || type === noUnderscore) {
|
|
return val || 'all';
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
return null;
|
|
}
|
|
|
|
/**
|
|
* Evaluates whether a user with given roles and token claims has permission for a specific claim and action.
|
|
* If a role claim is not present, the user is fully restricted to performing actions associated with claim in role.
|
|
*/
|
|
export function evaluateUserPermission(
|
|
roles: string[] = [],
|
|
claims: Record<string, any> = {},
|
|
claim: RoleClaim,
|
|
action: ClaimAction = 'view'
|
|
): boolean {
|
|
// Security lockout: Partner role is completely locked out of this console
|
|
const isPartner = roles.some((r) => r.toLowerCase().trim() === 'partner');
|
|
if (isPartner) return false;
|
|
|
|
// Unrestricted Admin or unrestricted claim -> full access
|
|
const hasUnrestrictedRole = roles.some((r) => r.toLowerCase().trim() === 'admin');
|
|
if (hasUnrestrictedRole) return true;
|
|
|
|
const rawUnrestricted = extractExplicitClaimValue(claims, 'unrestricted');
|
|
if (
|
|
rawUnrestricted === 'all' ||
|
|
rawUnrestricted === 'true' ||
|
|
rawUnrestricted === '1' ||
|
|
claims.unrestricted === true
|
|
) {
|
|
return true;
|
|
}
|
|
|
|
if (claim === 'unrestricted') {
|
|
return hasUnrestrictedRole;
|
|
}
|
|
|
|
// 1. Check if user has explicit claim in claims dictionary
|
|
const rawClaimValue = extractExplicitClaimValue(claims, claim);
|
|
if (rawClaimValue !== null && rawClaimValue !== '') {
|
|
const actionSet = resolveClaimActionSet(rawClaimValue);
|
|
return actionSet.has('all') || actionSet.has(action);
|
|
}
|
|
|
|
// 2. Check base role mappings
|
|
let claimFoundInRole = false;
|
|
for (const r of roles) {
|
|
const normalizedRole = r.toLowerCase().trim();
|
|
const allowedClaims = ROLE_CLAIM_MAP[normalizedRole];
|
|
if (allowedClaims && allowedClaims.includes(claim)) {
|
|
claimFoundInRole = true;
|
|
const actionSet = resolveClaimActionSet(undefined, normalizedRole);
|
|
if (actionSet.has('all') || actionSet.has(action)) {
|
|
return true;
|
|
}
|
|
}
|
|
}
|
|
|
|
// If a role claim is not present, the user is fully restricted
|
|
return false;
|
|
}
|
|
|
|
/**
|
|
* Evaluates Maker-Checker separation of duties constraint.
|
|
* In PFM governance, the user who created (or initiated) a record ("Maker")
|
|
* is strictly barred from approving ("Checking") their own record.
|
|
*
|
|
* @param createdBy The user identifier of the record creator (Guid, sub, email)
|
|
* @param currentUserId Current logged-in user ID (user.id or sub)
|
|
* @param currentUserSub Current logged-in user subject claim
|
|
* @param currentUserEmail Current logged-in user email
|
|
* @returns boolean true if user is the creator (Maker), false otherwise
|
|
*/
|
|
export function isRecordMaker(
|
|
createdBy?: string | null,
|
|
currentUserId?: string | null,
|
|
currentUserSub?: string | null,
|
|
currentUserEmail?: string | null
|
|
): boolean {
|
|
if (!createdBy) return false;
|
|
const creator = createdBy.trim().toLowerCase();
|
|
if (currentUserId && creator === currentUserId.trim().toLowerCase()) return true;
|
|
if (currentUserSub && creator === currentUserSub.trim().toLowerCase()) return true;
|
|
if (currentUserEmail && creator === currentUserEmail.trim().toLowerCase()) return true;
|
|
return false;
|
|
}
|
|
|
|
/**
|
|
* React hook exposing RBAC evaluation helpers for components.
|
|
*/
|
|
export function useRbac() {
|
|
const { roles, claims, user, sub } = useAuth();
|
|
|
|
const permissions = useMemo(() => {
|
|
const isUnrestricted =
|
|
roles.some((r) => r.toLowerCase().trim() === 'admin') ||
|
|
claims?.unrestricted === true ||
|
|
claims?.unrestricted === 'all';
|
|
|
|
const canAccess = (claim: RoleClaim, action: ClaimAction = 'view'): boolean => {
|
|
return evaluateUserPermission(roles, claims, claim, action);
|
|
};
|
|
|
|
const canView = (claim: RoleClaim): boolean => canAccess(claim, 'view');
|
|
const canAdd = (claim: RoleClaim): boolean => canAccess(claim, 'add');
|
|
const canApprove = (claim: RoleClaim): boolean => canAccess(claim, 'update');
|
|
const canExport = (claim: RoleClaim): boolean => canAccess(claim, 'export');
|
|
|
|
const isMaker = (createdBy?: string | null): boolean => {
|
|
return isRecordMaker(createdBy, user?.id, sub, user?.email);
|
|
};
|
|
|
|
const canApproveRecord = (claim: RoleClaim, createdBy?: string | null): boolean => {
|
|
if (!canApprove(claim)) return false;
|
|
// Maker-Checker policy: record creator cannot approve their own record
|
|
return !isMaker(createdBy);
|
|
};
|
|
|
|
const getApprovalRestrictionReason = (claim: RoleClaim, createdBy?: string | null): string | null => {
|
|
if (!canApprove(claim)) return 'Requires update/approval permission';
|
|
if (isMaker(createdBy)) return 'Maker-Checker policy: Record creators cannot approve their own records';
|
|
return null;
|
|
};
|
|
|
|
return {
|
|
isUnrestricted,
|
|
canAccess,
|
|
canView,
|
|
canAdd,
|
|
canApprove,
|
|
canExport,
|
|
isMaker,
|
|
canApproveRecord,
|
|
getApprovalRestrictionReason,
|
|
};
|
|
}, [roles, claims, user, sub]);
|
|
|
|
return permissions;
|
|
}
|
|
|
|
/**
|
|
* Route protection component for claim-restricted screens.
|
|
*/
|
|
export const ClaimProtectedRoute: React.FC<{
|
|
claim: RoleClaim;
|
|
action?: ClaimAction;
|
|
children: React.ReactNode;
|
|
}> = ({ claim, action = 'view', children }) => {
|
|
const { canAccess, canView } = useRbac();
|
|
const allowed = canAccess(claim, action);
|
|
|
|
if (!allowed) {
|
|
let fallbackPath = '/dashboard';
|
|
if (canView('dashboard')) fallbackPath = '/dashboard';
|
|
else if (canView('compliance')) fallbackPath = '/compliance';
|
|
else if (canView('projects_milestones')) fallbackPath = '/projects';
|
|
else if (canView('grant_financials')) fallbackPath = '/grants';
|
|
else if (canView('evidence_risks')) fallbackPath = '/monitoring';
|
|
else if (canView('governance')) fallbackPath = '/governance';
|
|
else if (canView('beneficiaries')) fallbackPath = '/projects/beneficiaries';
|
|
else if (canView('settings_users') || canView('settings_invites')) fallbackPath = '/settings';
|
|
|
|
return React.createElement(Navigate, { to: fallbackPath, replace: true });
|
|
}
|
|
|
|
return React.createElement(React.Fragment, null, children);
|
|
};
|
|
|
|
/**
|
|
* Route protection for Tenant Management (Solution Owners [Tenant 1 + Admin] OR Tenant Self-Service users).
|
|
*/
|
|
export const TenantManagementProtectedRoute: React.FC<{
|
|
children: React.ReactNode;
|
|
}> = ({ children }) => {
|
|
const { canManageTenants, isLoading } = useAuth();
|
|
const { canView, canAccess } = useRbac();
|
|
|
|
if (isLoading) {
|
|
return null;
|
|
}
|
|
|
|
const hasAccess =
|
|
canManageTenants ||
|
|
canView('tenant_management') ||
|
|
canView('tenant_self_service') ||
|
|
canAccess('tenant_self_service');
|
|
|
|
if (!hasAccess) {
|
|
return React.createElement(Navigate, { to: '/dashboard', replace: true });
|
|
}
|
|
|
|
return React.createElement(React.Fragment, null, children);
|
|
};
|