release: 1.0.0

src/routes/role-authority.ts

@@ -0,0 +1,18 @@
+import type { Pool } from 'pg';
+
+/**
+ * Whether the caller may hand out this role at all: assigning it is exercising
+ * authority over the organization the role lives in, not over the user.
+ */
+export async function callerControlsRoleOrg(
+    db: Pool, callerId: string, roleId: string, activity: string,
+): Promise<boolean> {
+    const { rows } = await db.query<{ ok: boolean }>(
+        `SELECT EXISTS (
+             SELECT 1 FROM morbac.roles r
+             WHERE r.id = $2::UUID AND morbac.is_allowed($1::UUID, r.org_id, $3, 'user_roles')
+         ) AS ok`,
+        [callerId, roleId, activity],
+    );
+    return rows[0]?.ok ?? false;
+}