Release v2.17.0: add read-only user previews and access fallbacks

src/rbac.js

@@ -2,7 +2,7 @@
 
 const PERMISSION_SECTIONS = [
   {
-    sectionName: 'Main navigation',
+    sectionName: 'Main Navigation',
     order: 10,
     permissions: [
       {
@@ -10,8 +10,7 @@ const PERMISSION_SECTIONS = [
         order: 10,
         name: 'Dashboard',
         permissions: [
-          { key: 'read', name: 'Read', description: 'Access the dashboard overview.' },
-          { key: 'allow', name: 'Allow', description: 'Send global player commands.' }
+          { key: 'read', name: 'Read', description: 'Access the dashboard overview.' }
         ]
       },
       {
@@ -213,6 +212,14 @@ const PERMISSION_SECTIONS = [
           { key: 'allow', name: 'Allow', description: 'Resend pending user invitations.' }
         ]
       },
+      {
+        key: 'impersonate',
+        order: 25,
+        name: 'Impersonate',
+        permissions: [
+          { key: 'allow', name: 'Allow', description: 'Preview a user account in read-only mode.' }
+        ]
+      },
       {
         key: 'rbac',
         order: 20,
@@ -237,7 +244,7 @@ const PERMISSION_SECTIONS = [
       {
         key: 'background-tasks',
         order: 40,
-        name: 'Task Queue',
+        name: 'Task queue',
         permissions: [
           { key: 'read', name: 'Read', description: 'View queued background tasks.' },
           { key: 'allow', name: 'Allow', description: 'Manage queued background tasks and clear finished items.' }
@@ -343,6 +350,9 @@ function hasPermission(currentUser, permissionKey) {
   if (!normalizedPermissionKey || !currentUser) {
     return false;
   }
+  if (currentUser.isViewingAs && normalizedPermissionKey.endsWith('.allow')) {
+    return false;
+  }
 
   const permissionKeys = Array.isArray(currentUser.permissionKeys)
     ? currentUser.permissionKeys
@@ -353,6 +363,16 @@ function hasPermission(currentUser, permissionKey) {
   return normalizePermissionKeys(permissionKeys).includes(normalizedPermissionKey);
 }
 
+function hasAssignedPermission(currentUser, permissionKey) {
+  if (!currentUser) {
+    return false;
+  }
+  if (!currentUser.isViewingAs) {
+    return hasPermission(currentUser, permissionKey);
+  }
+  return hasPermission(Object.assign({}, currentUser, { isViewingAs: false }), permissionKey);
+}
+
 function hasAnyPermission(currentUser, permissionKeys) {
   const normalizedPermissionKeys = normalizePermissionKeys(permissionKeys);
   if (!normalizedPermissionKeys.length || !currentUser) {
@@ -398,6 +418,7 @@ module.exports = {
   PERMISSION_SECTIONS,
   DEFAULT_ROLE,
   hasPermission,
+  hasAssignedPermission,
   hasAnyPermission,
   requirePermission,
   normalizePermissionKeys,