Something went wrong. Try again.
[READ-ONLY] Mirror of https://github.com/openstatusHQ/openstatus. 🫖 Status page with uptime monitoring & API monitoring as code 🫖 openstatus.dev
bun drizzle-orm monitoring monitoring-as-code nextjs observability on-call open-source shadcn-ui status-page statuspage synthetic-monitoring tinybird turso uptime uptime-checker uptime-monitor
Something went wrong. Try again.
1.2 kB · 36 lines
TypeScript
12345678910111213141516171819202122232425262728293031323334353637import type { WorkspaceRole } from "@openstatus/db/src/schema";
import { type DB, type ServiceContext, tryGetActorUserId } from "../context";import { ForbiddenError } from "../errors";import { getMembership } from "../member/membership";
/** * Assert the actor's workspace role is one of `roles`, or that the actor is * `orUserId`. `system` always passes; key-based actors without a linked user * pass only member-level checks. */export async function requireRole( db: DB, ctx: ServiceContext, roles: ReadonlyArray<WorkspaceRole>, opts: { orUserId?: number | null } = {},): Promise<void> { const { actor } = ctx; if (actor.type === "system") return;
const userId = tryGetActorUserId(actor); if (userId !== null) { if (opts.orUserId != null && opts.orUserId === userId) return; const membership = await getMembership(db, userId, ctx.workspace.id); if (membership && roles.includes(membership.role)) return; throw new ForbiddenError(`Requires one of the roles: ${roles.join(", ")}`); }
if ( (actor.type === "apiKey" || actor.type === "mcp") && roles.includes("member") ) { return; } throw new ForbiddenError(`Requires one of the roles: ${roles.join(", ")}`);}