feat(auth): harden Authentik and guest capability boundaries

2026-08-30 05:59:49 +02:00
parent b93d926b94
commit 96f90373dc
15 changed files with 928 additions and 8 deletions
@@ -0,0 +1,45 @@
+export type WorkbenchAccessMode = 'open' | 'operator' | 'guest'
+
+export interface WorkbenchAccessCapabilities {
+  analyzePersistedData: boolean
+  selectModels: boolean
+  runQualityChecks: boolean
+  exportResults: boolean
+  acquireSources: boolean
+  manageWorkspace: boolean
+  manageModels: boolean
+  writeDerivedDatasets: boolean
+  reviewEvidence: boolean
+  runChangeDetection: boolean
+}
+
+const OPERATOR_CAPABILITIES: WorkbenchAccessCapabilities = {
+  analyzePersistedData: true,
+  selectModels: true,
+  runQualityChecks: true,
+  exportResults: true,
+  acquireSources: true,
+  manageWorkspace: true,
+  manageModels: true,
+  writeDerivedDatasets: true,
+  reviewEvidence: true,
+  runChangeDetection: true,
+}
+
+const GUEST_CAPABILITIES: WorkbenchAccessCapabilities = {
+  analyzePersistedData: true,
+  selectModels: true,
+  runQualityChecks: true,
+  exportResults: true,
+  acquireSources: true,
+  manageWorkspace: false,
+  manageModels: false,
+  writeDerivedDatasets: true,
+  reviewEvidence: false,
+  runChangeDetection: true,
+}
+
+/** Mirrors the backend's explicit guest route boundary without weakening it. */
+export function getWorkbenchAccessCapabilities(mode: WorkbenchAccessMode): WorkbenchAccessCapabilities {
+  return mode === 'guest' ? GUEST_CAPABILITIES : OPERATOR_CAPABILITIES
+}