update oauth

apps/sso-core/src/domain/access.service.ts

@@ -6,13 +6,20 @@ export interface UserAccessContext {
   permissions: string[];
   canAccessAdmin: boolean;
   canManageRoles: boolean;
+  canViewOAuth: boolean;
   canManageOAuth: boolean;
+  canManageAllOAuth: boolean;
   canManageUsers: boolean;
+  canManageAllUsers: boolean;
   canViewUsers: boolean;
   canManageSettings: boolean;
   canViewUserDocuments: boolean;
 }
 
+function hasAnyPermission(permissions: string[], ...slugs: string[]) {
+  return slugs.some((slug) => permissions.includes(slug));
+}
+
 @Injectable()
 export class AccessService {
   constructor(private readonly prisma: PrismaService) {}
@@ -21,11 +28,27 @@ export class AccessService {
     if (isSuperAdmin) {
       return {
         roles: ['super-admin'],
-        permissions: ['admin.access', 'oauth.manage', 'users.manage', 'users.read', 'settings.manage', 'rbac.manage', 'documents.view_others'],
+        permissions: [
+          'admin.access',
+          'oauth.view',
+          'oauth.view.all',
+          'oauth.manage',
+          'oauth.manage.all',
+          'users.view',
+          'users.view.all',
+          'users.manage',
+          'users.manage.all',
+          'settings.manage',
+          'rbac.manage',
+          'documents.view_others'
+        ],
         canAccessAdmin: true,
         canManageRoles: true,
+        canViewOAuth: true,
         canManageOAuth: true,
+        canManageAllOAuth: true,
         canManageUsers: true,
+        canManageAllUsers: true,
         canViewUsers: true,
         canManageSettings: true,
         canViewUserDocuments: true
@@ -48,19 +71,39 @@ export class AccessService {
     const roles = links.map((link) => link.role.slug);
     const permissions = [...new Set(links.flatMap((link) => link.role.permissions.map((item) => item.permission.slug)))];
 
+    const canViewOAuth = hasAnyPermission(permissions, 'oauth.view', 'oauth.view.all', 'oauth.manage', 'oauth.manage.all');
+    const canManageOAuth = hasAnyPermission(permissions, 'oauth.manage', 'oauth.manage.all');
+    const canManageAllOAuth = permissions.includes('oauth.manage.all');
+    const canViewUsers = hasAnyPermission(permissions, 'users.view', 'users.view.all', 'users.manage', 'users.manage.all', 'users.read');
+    const canManageUsers = hasAnyPermission(permissions, 'users.manage', 'users.manage.all');
+    const canManageAllUsers = permissions.includes('users.manage.all');
+
     return {
       roles,
       permissions,
       canAccessAdmin: permissions.includes('admin.access'),
       canManageRoles: false,
-      canManageOAuth: permissions.includes('oauth.manage'),
-      canManageUsers: permissions.includes('users.manage'),
-      canViewUsers: permissions.includes('users.manage') || permissions.includes('users.read'),
+      canViewOAuth,
+      canManageOAuth,
+      canManageAllOAuth,
+      canManageUsers,
+      canManageAllUsers,
+      canViewUsers,
       canManageSettings: permissions.includes('settings.manage'),
       canViewUserDocuments: permissions.includes('documents.view_others')
     };
   }
 
+  canManageOAuthClient(
+    access: UserAccessContext,
+    actorUserId: string,
+    client: { createdById: string | null }
+  ) {
+    if (access.canManageAllOAuth) return true;
+    if (access.canManageOAuth && client.createdById === actorUserId) return true;
+    return false;
+  }
+
   async assertSuperAdmin(actorUserId: string) {
     const actor = await this.prisma.user.findUnique({ where: { id: actorUserId } });
     if (!actor?.isSuperAdmin) {