ftb-project-management/apps/web/lib/permissions.ts

import type { RoleItem } from './members';

export type Permission = string;

export interface ActionDef {
  action: 'view' | 'create' | 'edit' | 'delete' | 'manage' | 'export';
  label: string;
  permission: string;
}

export interface PermissionGroup {
  module: string;
  moduleLabel: string;
  category: 'main' | 'version_tab';
  actions: ActionDef[];
}

const std4 = (mod: string): ActionDef[] => [
  { action: 'view', label: '查看', permission: `${mod}:view` },
  { action: 'create', label: '创建', permission: `${mod}:create` },
  { action: 'edit', label: '编辑', permission: `${mod}:edit` },
  { action: 'delete', label: '删除', permission: `${mod}:delete` },
];

const stdTab = (mod: string): ActionDef[] => [
  { action: 'view', label: '查看', permission: `${mod}:view` },
  { action: 'manage', label: '管理', permission: `${mod}:manage` },
];

export const PERMISSION_GROUPS: PermissionGroup[] = [
  { module: 'product', moduleLabel: '产品', category: 'main', actions: std4('product') },
  { module: 'project', moduleLabel: '项目', category: 'main', actions: std4('project') },
  { module: 'version', moduleLabel: '版本', category: 'main', actions: std4('version') },
  { module: 'requirement', moduleLabel: '需求池', category: 'main', actions: std4('requirement') },
  {
    module: 'overtime',
    moduleLabel: '加班记录',
    category: 'main',
    actions: [
      { action: 'view', label: '查看', permission: 'overtime:view' },
      { action: 'create', label: '创建', permission: 'overtime:create' },
      { action: 'delete', label: '删除', permission: 'overtime:delete' },
      { action: 'export', label: '导出', permission: 'overtime:export' },
    ],
  },
  {
    module: 'xiaobao.warning',
    moduleLabel: '小宝预警',
    category: 'main',
    actions: [
      { action: 'view', label: '查看', permission: 'xiaobao.warning:view' },
      { action: 'manage', label: '管理', permission: 'xiaobao.warning:manage' },
    ],
  },
  { module: 'member', moduleLabel: '成员', category: 'main', actions: std4('member') },
  { module: 'role', moduleLabel: '角色', category: 'main', actions: std4('role') },
  { module: 'version.req', moduleLabel: '需求 Tab', category: 'version_tab', actions: stdTab('version.req') },
  { module: 'version.research', moduleLabel: '调研 Tab', category: 'version_tab', actions: stdTab('version.research') },
  { module: 'version.product_plan', moduleLabel: '产品方案 Tab', category: 'version_tab', actions: stdTab('version.product_plan') },
  { module: 'version.ui_plan', moduleLabel: 'UI 设计 Tab', category: 'version_tab', actions: stdTab('version.ui_plan') },
  { module: 'version.devtask', moduleLabel: '开发任务 Tab', category: 'version_tab', actions: stdTab('version.devtask') },
  { module: 'version.testcase', moduleLabel: '测试用例 Tab', category: 'version_tab', actions: stdTab('version.testcase') },
  { module: 'version.bug', moduleLabel: 'Bug Tab', category: 'version_tab', actions: std4('version.bug') },
];

export const ALL_PERMISSIONS: string[] = PERMISSION_GROUPS.flatMap((g) => g.actions.map((a) => a.permission));

const VIEW_ONLY_BASE = ['product:view', 'project:view', 'version:view', 'requirement:view', 'version.req:view'];

export const DEFAULT_ROLE_PERMISSIONS: Record<string, string[]> = {
  'role-admin': ['*'],
  'role-pm': [
    ...std4('product').map((a) => a.permission),
    ...std4('project').map((a) => a.permission),
    ...std4('version').map((a) => a.permission),
    ...std4('requirement').map((a) => a.permission),
    'version.req:view', 'version.req:manage',
    'version.product_plan:view', 'version.product_plan:manage',
    'xiaobao.warning:view', 'xiaobao.warning:manage',
    'overtime:view', 'member:view', 'role:view',
    'version.research:view', 'version.ui_plan:view', 'version.devtask:view',
    'version.testcase:view', 'version.bug:view',
  ],
  'role-dev': [
    ...VIEW_ONLY_BASE,
    'version.devtask:view', 'version.devtask:manage',
    'version.bug:view', 'version.bug:edit',
    'version.research:view', 'version.product_plan:view', 'version.ui_plan:view', 'version.testcase:view',
    'xiaobao.warning:view',
    'overtime:view', 'overtime:create',
  ],
  'role-test': [
    ...VIEW_ONLY_BASE,
    'version.testcase:view', 'version.testcase:manage',
    'version.bug:view', 'version.bug:create', 'version.bug:edit', 'version.bug:delete',
    'version.research:view', 'version.product_plan:view', 'version.ui_plan:view', 'version.devtask:view',
    'xiaobao.warning:view',
    'overtime:view', 'overtime:create',
  ],
  'role-design': [
    ...VIEW_ONLY_BASE,
    'version.ui_plan:view', 'version.ui_plan:manage',
    'version.research:view', 'version.product_plan:view', 'version.devtask:view',
    'version.testcase:view', 'version.bug:view',
    'xiaobao.warning:view',
    'overtime:view', 'overtime:create',
  ],
  'role-lead': [
    ...VIEW_ONLY_BASE,
    'version.research:view', 'version.product_plan:view', 'version.ui_plan:view',
    'version.devtask:view', 'version.devtask:manage',
    'version.testcase:view', 'version.testcase:manage',
    'version.bug:view', 'version.bug:create', 'version.bug:edit', 'version.bug:delete',
    'xiaobao.warning:view',
    'overtime:view', 'overtime:create', 'overtime:export',
  ],
};

export const DEFAULT_ROLE_PRESETS: RoleItem[] = [
  { id: 'role-admin', name: '超级管理员', description: '拥有系统全部权限', createdAt: '2024-01-01', isSystem: true, permissions: DEFAULT_ROLE_PERMISSIONS['role-admin'] },
  { id: 'role-pm', name: '产品经理', description: '管理产品和需求', createdAt: '2024-01-01', permissions: DEFAULT_ROLE_PERMISSIONS['role-pm'] },
  { id: 'role-lead', name: '组长', description: '管理本组任务和本部门加班记录', createdAt: '2024-01-01', permissions: DEFAULT_ROLE_PERMISSIONS['role-lead'] },
  { id: 'role-dev', name: '开发工程师', description: '负责开发任务', createdAt: '2024-01-01', permissions: DEFAULT_ROLE_PERMISSIONS['role-dev'] },
  { id: 'role-test', name: '测试工程师', description: '负责测试任务', createdAt: '2024-01-01', permissions: DEFAULT_ROLE_PERMISSIONS['role-test'] },
  { id: 'role-design', name: '设计师', description: '负责UI/UX设计', createdAt: '2024-01-01', permissions: DEFAULT_ROLE_PERMISSIONS['role-design'] },
];

export function hasPermission(role: RoleItem | undefined, permission: string): boolean {
  if (!role) return false;
  if (role.permissions.includes('*')) return true;
  return role.permissions.includes(permission);
}