Access Control

import { allowAllGuard, roleBasedGuard, AccessLevel } from "@swenyai/providers/access";

Interface

interface AccessGuard {
  resolveAccessLevel(user: UserIdentity): AccessLevel;
  assertNotForbidden(user: UserIdentity): void;
  assertCanQuery(user: UserIdentity): void;
  assertCanMutate(user: UserIdentity): void;
}

enum AccessLevel {
  FORBIDDEN = "forbidden",
  READ_ONLY = "read_only",
  READ_WRITE = "read_write",
  ADMIN = "admin",
}

Allow All

Grants READ_WRITE to every user:

const guard = allowAllGuard();

Role-Based

Maps user roles to access levels:

const guard = roleBasedGuard({
  admin: ["platform-admin", "superuser"],
  readWrite: ["engineer", "developer"],
  readOnly: ["viewer", "support"],
});

Users with no matching roles are FORBIDDEN. Throws AccessDeniedError on assertion failures.