llmgw/internal/web/roles.go

package web

import (
	"net/http"
	"strings"

	"gitea.mynodes.xyz/ilker/llmgw/internal/store"
)

// staffMay reports whether a person may do this to an administration page.
//
// An administrator may do anything. A viewer may look at every page and
// change nothing. An operator may also run the cluster from them: models
// through the mirror, and a node's engines. Billing may look at usage and
// quotas. Everything that touches people, the tree, limits or keys stays
// with administrators.
func staffMay(u store.User, r *http.Request) bool {
	if u.IsAdmin {
		return true
	}
	read := r.Method == http.MethodGet || r.Method == http.MethodHead
	path := r.URL.Path
	switch u.Role {
	case store.RoleViewer:
		return read
	case store.RoleOperator:
		return read || strings.HasPrefix(path, "/admin/mirror/") ||
			strings.HasPrefix(path, "/admin/nodes/") && strings.HasSuffix(path, "/engines")
	case store.RoleBilling:
		return read && (path == "/admin/usage" || path == "/admin/quotas")
	}
	return false
}