chore: establish local platform baseline

internal/identity/permissions.go

@@ -0,0 +1,79 @@
+package identity
+
+import "sort"
+
+type Role string
+type Capability string
+
+const (
+	RoleOwner  Role = "owner"
+	RoleAdmin  Role = "admin"
+	RoleEditor Role = "editor"
+	RoleViewer Role = "viewer"
+)
+
+const (
+	CapabilityHouseholdRead     Capability = "household.read"
+	CapabilityHouseholdManage   Capability = "household.manage"
+	CapabilityMemberManage      Capability = "member.manage"
+	CapabilityOwnershipTransfer Capability = "ownership.transfer"
+	CapabilitySubjectRead       Capability = "subject.read"
+	CapabilitySubjectWrite      Capability = "subject.write"
+	CapabilityConversationRead  Capability = "conversation.read"
+	CapabilityStoryReview       Capability = "story.review"
+	CapabilityDeviceManage      Capability = "device.manage"
+	CapabilityFirmwareManage    Capability = "firmware.manage"
+	CapabilityRecordingPlay     Capability = "recording.play"
+	CapabilityRecordingDownload Capability = "recording.download"
+	CapabilityPrivacyRead       Capability = "privacy.read"
+	CapabilityPrivacyManage     Capability = "privacy.manage"
+)
+
+var roleCapabilities = map[Role]map[Capability]struct{}{
+	RoleOwner: capabilitySet(
+		CapabilityHouseholdRead, CapabilityHouseholdManage, CapabilityMemberManage,
+		CapabilityOwnershipTransfer, CapabilitySubjectRead, CapabilitySubjectWrite,
+		CapabilityConversationRead, CapabilityStoryReview, CapabilityDeviceManage,
+		CapabilityFirmwareManage, CapabilityPrivacyRead, CapabilityPrivacyManage,
+	),
+	RoleAdmin: capabilitySet(
+		CapabilityHouseholdRead, CapabilityHouseholdManage, CapabilityMemberManage,
+		CapabilitySubjectRead, CapabilitySubjectWrite, CapabilityConversationRead,
+		CapabilityStoryReview, CapabilityDeviceManage,
+		CapabilityFirmwareManage, CapabilityPrivacyRead,
+	),
+	RoleEditor: capabilitySet(
+		CapabilityHouseholdRead, CapabilitySubjectRead, CapabilitySubjectWrite,
+		CapabilityConversationRead, CapabilityStoryReview, CapabilityDeviceManage,
+	),
+	RoleViewer: capabilitySet(
+		CapabilityHouseholdRead, CapabilitySubjectRead, CapabilityConversationRead,
+	),
+}
+
+func Can(role Role, capability Capability) bool {
+	capabilities, ok := roleCapabilities[role]
+	if !ok {
+		return false
+	}
+	_, ok = capabilities[capability]
+	return ok
+}
+
+func CapabilitiesForRole(role Role) []Capability {
+	set := roleCapabilities[role]
+	result := make([]Capability, 0, len(set))
+	for capability := range set {
+		result = append(result, capability)
+	}
+	sort.Slice(result, func(i, j int) bool { return result[i] < result[j] })
+	return result
+}
+
+func capabilitySet(capabilities ...Capability) map[Capability]struct{} {
+	set := make(map[Capability]struct{}, len(capabilities))
+	for _, capability := range capabilities {
+		set[capability] = struct{}{}
+	}
+	return set
+}