All files / libs/kernel/auth/shared/src/abilities/users definitions.ts

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
1x
1x
1x
1x
1x
1x
1x
135x
135x
135x
135x
 
 
135x
135x
1x
 
import { SubjectsEnum, type DefinePermissions, type UserRoleForAccessControl } from '../../types';
 
import { UsersActions } from './actions';
import { type ImpersonateUserSubject } from './subjects';
 
export const usersAbilityDefinitions = {
  ADMIN(authenticatedContext, { can }) {
    can(
      UsersActions.impersonate,
      SubjectsEnum.User,
      (user: ImpersonateUserSubject) =>
        // You cannot impersonate yourself.
        ![authenticatedContext.impersonation?.impersonator.email, authenticatedContext.user.email].includes(user.email),
    );
  },
} as const satisfies Partial<Record<UserRoleForAccessControl, DefinePermissions>>;