From 2b389ac66bb5b3b49bc87abef72c0765720b98b6 Mon Sep 17 00:00:00 2001
From: Marc Villain <marc.villain@epita.fr>
Date: Sun, 17 May 2026 18:35:41 +0200
Subject: [PATCH] feat(modules): add service connectors and cleanup settings

---
 src/permissions.ts | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/src/permissions.ts b/src/permissions.ts
index 417b768..15ab5dc 100644
--- a/src/permissions.ts
+++ b/src/permissions.ts
@@ -49,6 +49,13 @@ export async function getAccountType(
     return rows[0]?.account_type ?? null;
 }
 
+export type ApiKeyScope = 'inherit' | Array<{ activity: string; view: string }>;
+
+function scopeAllows(scope: ApiKeyScope | undefined, activity: string, target: string): boolean {
+    if (!scope || scope === 'inherit') return true;
+    return scope.some((p) => p.activity === activity && p.view === target);
+}
+
 export async function hasPermission(
     db: Pool,
     req: FastifyRequest,
@@ -62,6 +69,11 @@ export async function hasPermission(
         reply.code(401).send({ error: 'Authentication required' });
         return false;
     }
+    const apiKeyScope = ((req as unknown) as Record<string, unknown>).apiKeyScope as ApiKeyScope | undefined;
+    if (!scopeAllows(apiKeyScope, activity, target)) {
+        reply.code(403).send({ error: 'Insufficient permissions' });
+        return false;
+    }
     const { rows } = await db.query<{ allowed: boolean }>(
         'SELECT morbac.is_allowed($1::UUID, $2::UUID, $3, $4) AS allowed',
         [user.id, orgId, activity, target],