roles update

apps/sso-core/src/domain/access.service.ts

@@ -1,4 +1,4 @@
-import { ForbiddenException, Injectable } from '@nestjs/common';
+import { ForbiddenException, Injectable, NotFoundException } from '@nestjs/common';
 import { PrismaService } from '../infra/prisma.service';
 
 export interface UserAccessContext {
@@ -55,21 +55,29 @@ export class AccessService {
       };
     }
 
-    const links = await this.prisma.userRole.findMany({
-      where: { userId },
-      include: {
-        role: {
-          include: {
-            permissions: {
-              include: { permission: true }
+    const [roleLinks, directLinks] = await Promise.all([
+      this.prisma.userRole.findMany({
+        where: { userId },
+        include: {
+          role: {
+            include: {
+              permissions: {
+                include: { permission: true }
+              }
             }
           }
         }
-      }
-    });
+      }),
+      this.prisma.userPermission.findMany({
+        where: { userId },
+        include: { permission: true }
+      })
+    ]);
 
-    const roles = links.map((link) => link.role.slug);
-    const permissions = [...new Set(links.flatMap((link) => link.role.permissions.map((item) => item.permission.slug)))];
+    const roles = roleLinks.map((link) => link.role.slug);
+    const rolePermissions = roleLinks.flatMap((link) => link.role.permissions.map((item) => item.permission.slug));
+    const directPermissions = directLinks.map((link) => link.permission.slug);
+    const permissions = [...new Set([...rolePermissions, ...directPermissions])];
 
     const canViewOAuth = hasAnyPermission(permissions, 'oauth.view', 'oauth.view.all', 'oauth.manage', 'oauth.manage.all');
     const canManageOAuth = hasAnyPermission(permissions, 'oauth.manage', 'oauth.manage.all');
@@ -82,7 +90,7 @@ export class AccessService {
       roles,
       permissions,
       canAccessAdmin: permissions.includes('admin.access'),
-      canManageRoles: false,
+      canManageRoles: permissions.includes('rbac.manage'),
       canViewOAuth,
       canManageOAuth,
       canManageAllOAuth,
@@ -104,6 +112,18 @@ export class AccessService {
     return false;
   }
 
+  async assertRbacManage(actorUserId: string) {
+    const actor = await this.prisma.user.findUnique({ where: { id: actorUserId } });
+    if (!actor) {
+      throw new NotFoundException('Пользователь не найден');
+    }
+    if (actor.isSuperAdmin) return;
+    const access = await this.getUserAccess(actorUserId, false);
+    if (!access.canManageRoles) {
+      throw new ForbiddenException('Недостаточно прав для управления ролями и правами');
+    }
+  }
+
   async assertSuperAdmin(actorUserId: string) {
     const actor = await this.prisma.user.findUnique({ where: { id: actorUserId } });
     if (!actor?.isSuperAdmin) {