19 lines
642 B
TypeScript
19 lines
642 B
TypeScript
import type { Pool } from 'pg';
|
|
|
|
/**
|
|
* Whether the caller may hand out this role at all: assigning it is exercising
|
|
* authority over the organization the role lives in, not over the user.
|
|
*/
|
|
export async function callerControlsRoleOrg(
|
|
db: Pool, callerId: string, roleId: string, activity: string,
|
|
): Promise<boolean> {
|
|
const { rows } = await db.query<{ ok: boolean }>(
|
|
`SELECT EXISTS (
|
|
SELECT 1 FROM morbac.roles r
|
|
WHERE r.id = $2::UUID AND morbac.is_allowed($1::UUID, r.org_id, $3, 'user_roles')
|
|
) AS ok`,
|
|
[callerId, roleId, activity],
|
|
);
|
|
return rows[0]?.ok ?? false;
|
|
}
|