Implement RBAC roles system

src/web/session.js

@@ -1,3 +1,5 @@
+const { normalizePermissionKeys } = require('../rbac');
+
 function createSessionService(options) {
   const sessionCookieName = String(options && options.sessionCookieName || '').trim();
   const sessionMaxAgeMs = Number(options && options.sessionMaxAgeMs);
@@ -66,8 +68,34 @@ function createSessionService(options) {
       return null;
     }
 
+    const userId = Number(rows[0].id);
+    const [roleRows] = await pool.query(
+      `SELECT r.role_key
+       FROM user_roles ur
+       JOIN roles r ON r.id = ur.role_id
+       WHERE ur.user_id = ?
+       ORDER BY r.name ASC`,
+      [userId]
+    );
+    const [permissionRows] = await pool.query(
+      `SELECT p.permission_key
+       FROM user_roles ur
+       JOIN role_permissions rp ON rp.role_id = ur.role_id
+       JOIN permissions p ON p.id = rp.permission_id
+       WHERE ur.user_id = ?
+       ORDER BY p.section_name ASC, p.name ASC`,
+      [userId]
+    );
+
     await pool.query('UPDATE auth_sessions SET last_used_at = CURRENT_TIMESTAMP, modified_by = ? WHERE session_hash = ?', [rows[0].user_id, tokenHash]);
-    return rows[0];
+    return Object.assign({}, rows[0], {
+      roleKeys: roleRows.map(function (row) {
+        return String(row.role_key || '').trim();
+      }).filter(Boolean),
+      permissionKeys: normalizePermissionKeys(permissionRows.map(function (row) {
+        return String(row.permission_key || '').trim();
+      }))
+    });
   }
 
   async function createUserSession(pool, userId) {