Enforce 5-Role RBAC

export type Role = 'viewer' | 'operator' | 'manager' | 'admin' | 'superadmin';

export type Action = 'read' | 'create' | 'update' | 'delete' | 'approve' | 'export';

export type PermissionMatrix = Record<string, Partial<Record<Action, Role>>>;

import type { PermissionMatrix, Role } from '@/types/rbac';

export const ROLE_HIERARCHY: Record<Role, number> = {
  viewer: 1,
  operator: 2,
  manager: 3,
  admin: 4,
  superadmin: 5,
};

export const PERMISSIONS: PermissionMatrix = {
  // Module: incidents
  'incidents:read':    { read: 'viewer' },
  'incidents:create':  { create: 'operator' },
  'incidents:update':  { update: 'operator' },
  'incidents:delete':  { delete: 'admin' },
  'incidents:approve': { approve: 'manager' },
  'incidents:export':  { export: 'manager' },

  // Module: users
  'users:read':        { read: 'admin' },
  'users:create':      { create: 'admin' },
  'users:update':      { update: 'admin' },
  'users:delete':      { delete: 'superadmin' },

  // Module: audit-log
  'audit-log:read':    { read: 'admin' },
  'audit-log:export':  { export: 'superadmin' },

  // Module: reports
  'reports:read':      { read: 'viewer' },
  'reports:export':    { export: 'operator' },
};

import { NextRequest, NextResponse } from 'next/server';
import { requireSession } from './session';
import { checkAccess } from './permissions';
import { errorResponse } from '@/lib/response';
import type { TypedSession } from './session';
import type { Action } from '@/types/rbac';

type AuthenticatedHandler = (
  req: NextRequest,
  session: TypedSession
) => Promise<NextResponse>;

export function withPermission(
  resource: string,
  action: Action,
  handler: AuthenticatedHandler
) {
  return async (req: NextRequest): Promise<NextResponse> => {
    // Step 1: Verify authentication
    const session = await requireSession(); // throws 401 if no session

    // Step 2: Verify authorization
    if (!checkAccess(session.role, resource, action)) {
      return errorResponse('Forbidden', 403);
    }

    // Step 3: Execute handler with verified session
    return handler(req, session);
  };
}

import type { Role } from '@/types/rbac';
import { getUserRole } from '@/lib/db/users';
import { getGroupMembership } from './msal-config';

const GROUP_ROLE_MAP: Record<string, Role> = {
  'DS-Platform-Admins': 'admin',
  'DS-Platform-Managers': 'manager',
  'DS-Platform-Operators': 'operator',
  'DS-Platform-Viewers': 'viewer',
};

export async function resolveRole(
  userId: string,
  jwtRole?: string,
  accessToken?: string
): Promise<{ role: Role; source: string }> {
  // Step 1: JWT claim (no I/O)
  if (jwtRole && isValidRole(jwtRole)) {
    return { role: jwtRole as Role, source: 'jwt' };
  }

  // Step 2: Database lookup
  const dbRole = await getUserRole(userId);
  if (dbRole) {
    return { role: dbRole, source: 'database' };
  }

  // Step 3: Azure AD group membership
  if (accessToken) {
    const groups = await getGroupMembership(accessToken);
    for (const [groupName, role] of Object.entries(GROUP_ROLE_MAP)) {
      if (groups.includes(groupName)) {
        return { role, source: 'azure-ad-group' };
      }
    }
  }

  // Step 4: Default — least privilege
  return { role: 'viewer', source: 'default' };
}

function isValidRole(role: string): role is Role {
  return ['viewer', 'operator', 'manager', 'admin', 'superadmin'].includes(role);
}

'use client';

import { useSession } from 'next-auth/react';
import { ROLE_HIERARCHY } from '@/lib/auth/permissions';
import type { Role } from '@/types/rbac';

interface Props {
  minRole: Role;
  children: React.ReactNode;
  fallback?: React.ReactNode;
}

export function RoleGate({ minRole, children, fallback = null }: Props) {
  const { data: session } = useSession();
  const userRole = session?.role as Role | undefined;

  if (!userRole) return fallback;
  if (ROLE_HIERARCHY[userRole] < ROLE_HIERARCHY[minRole]) return fallback;

  return <>{children}</>;
}