Talenttrust-Backend/src/auth/roles.ts at main · Talenttrust/Talenttrust-Backend · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
/**
 * @module roles
 * @description Defines the role-based access control (RBAC) model for TalentTrust.
 *
 * Roles:
 *   - admin:      Full platform access — manages users, contracts, disputes.
 *   - freelancer: Can create/view own contracts, submit work, view own reputation.
 *   - client:     Can create/view own contracts, approve/reject deliverables.
 *   - guest:      Read-only access to public endpoints (health, public listings).
 *
 * Resources:
 *   contracts, users, reputation, disputes, health, api-keys
 *
 * Actions:
 *   create, read, update, delete
 */

export type Role = 'admin' | 'auditor' | 'freelancer' | 'client' | 'guest';

export type Resource = 'contracts' | 'users' | 'reputation' | 'disputes' | 'health' | 'api-keys';

export type Action = 'create' | 'read' | 'update' | 'delete';

/**
 * Access control matrix.
 * Maps each role to the set of allowed actions per resource.
 */
export const ACCESS_CONTROL_MATRIX: Record<Role, Partial<Record<Resource, Action[]>>> = {
  admin: {
    contracts: ['create', 'read', 'update', 'delete'],
    users: ['create', 'read', 'update', 'delete'],
    reputation: ['read', 'update'],
    disputes: ['create', 'read', 'update', 'delete'],
    health: ['read'],
    'api-keys': ['create', 'read', 'update', 'delete'],
  },
  auditor: {
    health: ['read'],
  },
  freelancer: {
    contracts: ['create', 'read'],
    users: ['read'],
    reputation: ['read', 'update'], // Can rate clients after contract completion
    disputes: ['create', 'read'],
    health: ['read'],
    'api-keys': ['create', 'read', 'update', 'delete'],
  },
  client: {
    contracts: ['create', 'read', 'update'],
    users: ['read'],
    reputation: ['read', 'update'], // Can rate freelancers after contract completion
    disputes: ['create', 'read'],
    health: ['read'],
    'api-keys': ['create', 'read', 'update', 'delete'],
  },
  guest: {
    health: ['read'],
  },
};

/** All valid roles in the system. */
export const VALID_ROLES: readonly Role[] = ['admin', 'auditor', 'freelancer', 'client', 'guest'] as const;