iu
2b2b342492
Backend (Go/Gin/pgx): env config, pgx pool with retries, Garage S3 client (path-style, region garage), embedded golang-migrate migrations, JWT auth with refresh rotation, albums CRUD, members/roles/invites with no-escalation matrix, photo upload + async imaging/goexif WebP variants, cursor pagination, presigned URLs, likes/comments, SSE hub (album + personal), notifications, share links. Frontend (SvelteKit 2 + Svelte 5 + Tailwind v4): API wrapper with 401 refresh, auth store, all screens, Uploader/PhotoGrid/Lightbox/Comments, SSE client with reconnect + REST catch-up, three themes + system via data-theme. Deploy without Docker: Makefile builds the frontend into backend/static and embeds it (go:embed) into a single statically linked binary; systemd unit and nginx SSE example included. Use gen2brain/webp (-tags nodynamic) instead of cgo kolesa-team/go-webp to keep CGO_ENABLED=0 static builds; design.md/proposal.md updated accordingly.
99 lines
1.7 KiB
Go
99 lines
1.7 KiB
Go
package roles
|
|
|
|
const (
|
|
Owner = "owner"
|
|
Admin = "admin"
|
|
Editor = "editor"
|
|
Member = "member"
|
|
Viewer = "viewer"
|
|
)
|
|
|
|
var rank = map[string]int{
|
|
Viewer: 0,
|
|
Member: 1,
|
|
Editor: 2,
|
|
Admin: 3,
|
|
Owner: 4,
|
|
}
|
|
|
|
func Rank(r string) int { return rank[r] }
|
|
|
|
func ValidMemberRole(r string) bool {
|
|
switch r {
|
|
case Admin, Editor, Member, Viewer:
|
|
return true
|
|
}
|
|
return false
|
|
}
|
|
|
|
func CanUpload(r string) bool {
|
|
switch r {
|
|
case Owner, Admin, Editor, Member:
|
|
return true
|
|
}
|
|
return false
|
|
}
|
|
|
|
func CanComment(r string) bool {
|
|
return CanUpload(r)
|
|
}
|
|
|
|
func CanDeleteAnyPhoto(r string) bool {
|
|
return r == Owner || r == Admin
|
|
}
|
|
|
|
func CanDeleteOwnPhoto(r string) bool {
|
|
return CanUpload(r)
|
|
}
|
|
|
|
func CanEditAlbum(r string) bool {
|
|
return r == Owner || r == Admin
|
|
}
|
|
|
|
func CanManageShares(r string) bool {
|
|
return r == Owner || r == Admin
|
|
}
|
|
|
|
func CanInvite(actorRole, targetRole string) bool {
|
|
if actorRole == Editor {
|
|
return targetRole == Member || targetRole == Viewer
|
|
}
|
|
if actorRole != Owner && actorRole != Admin {
|
|
return false
|
|
}
|
|
if targetRole == Owner {
|
|
return false
|
|
}
|
|
return Rank(targetRole) <= Rank(actorRole)
|
|
}
|
|
|
|
func CanChangeRole(actorRole, targetCurrent, newRole string) bool {
|
|
if targetCurrent == Owner || newRole == Owner {
|
|
return false
|
|
}
|
|
if !ValidMemberRole(newRole) {
|
|
return false
|
|
}
|
|
switch actorRole {
|
|
case Owner:
|
|
return true
|
|
case Admin:
|
|
if targetCurrent == Admin {
|
|
return false
|
|
}
|
|
return newRole == Editor || newRole == Member || newRole == Viewer
|
|
default:
|
|
return false
|
|
}
|
|
}
|
|
|
|
func CanRemoveMember(actorRole, targetRole string) bool {
|
|
if actorRole != Owner && actorRole != Admin {
|
|
return false
|
|
}
|
|
if targetRole == Owner || targetRole == Admin {
|
|
return false
|
|
}
|
|
return true
|
|
}
|