casl Proof of Concept

apps/backend/db_patches/9998_CaslPOC.sql

@@ -0,0 +1,117 @@
+DO
+$$
+BEGIN
+  IF register_patch('9998_CaslPOC.sql', 'scotthurley', 'Casl', '2026-01-29') THEN
+
+    BEGIN
+    CREATE TABLE IF NOT EXISTS permissions(
+                permission_id serial UNIQUE,
+                action varchar(100) DEFAULT NULL,
+                subject varchar(100) DEFAULT NULL,
+                conditions varchar(200) DEFAULT NULL,
+                is_db_permission bool DEFAULT false
+    );
+
+    CREATE TABLE IF NOT EXISTS role_has_permission(
+          role_id integer NOT NULL REFERENCES roles (role_id) ON UPDATE CASCADE ON DELETE CASCADE,
+          permission_id integer NOT NULL REFERENCES permissions (permission_id) ON UPDATE CASCADE ON DELETE CASCADE,
+          PRIMARY KEY (role_id, permission_id)
+    );
+
+    INSERT INTO permissions(action, subject, conditions, is_db_permission) VALUES
+        ('update', 'fap', '{ "user.userId": { "$in": "fap.fapChairUserIds" } }', false),
+        ('archive', 'call', ' { "shortCode": { "$regex": "/LSF/i" }}', false),
+        ('delete', 'proposal', '{"proposal.proposerId": "user.userId", "proposal.submitted": false}', false),
+        ('read', 'proposal', '{"isInternalReviewer": true}', false),
+        ('read', 'proposal', '{"isMemberOfFapProposal": true}', false),
+        ('read', 'proposal_dashboard', NULL, false),
+        ('delete', 'proposal', NULL, false),
+        ('create', 'proposal', NULL, false),
+        ('read', 'dashboard', NULL, false),
+        ('read', 'experiment_times', NULL, false),
+        ('read', 'call', NULL, false),
+        ('read', 'proposal', NULL, false),
+        ('read', 'permission', NULL, false),
+        ('read', 'technique_proposal', NULL, false),
+        ('read', 'experiment', NULL, false),
+        ('read', 'fap', NULL, false),
+        ('read', 'instrument', NULL, false),
+        ('read', 'technique', NULL, false),
+        ('read', 'tag', NULL, false),
+        ('read', 'proposal_workflow', NULL, false),
+        ('read', 'institution', NULL, false),
+        ('read', 'people', NULL, false),
+        ('read', 'question', NULL, false),
+        ('read', 'setting', NULL, false),
+        ('read', 'status_action_logs', NULL, false),
+        ('read', 'template', NULL, false),
+        ('read', 'proposal', '{"isVisitorOfProposal": true}', false),
+        ('read', 'proposal', '{"isDataAccessUserOfProposal": true}', false),
+        ('read', 'proposal', '{"isMemberOfProposal": true}', false),
+        ('read', 'proposal', '{"isInstrumentManagerToProposal": true}', false),
+        ('read', 'proposal', '{"isScientistToProposalTechnique": true}', false),
+        ('read', 'proposal', '{"isScientistToProposal": true}', false),
+        ('read', 'fap_proposal_assignment', NULL, false),
+        ('read', 'fap_proposal_assignment', '{"user_id": "userId"}', true),
+        ('update', 'fap', NULL, false);
+
+    INSERT INTO role_has_permission(role_id, permission_id) VALUES
+        (4,1),
+        (2,7),
+        (1,3),
+        (2,2),
+        (1,8),
+        (1,9),
+        (1,10),
+        (2,11),
+        (2,12),
+        (2,13),
+        (2,14),
+        (2,15),
+        (2,16),
+        (2,17),
+        (2,18),
+        (2,19),
+        (2,20),
+        (2,21),
+        (2,22),
+        (2,23),
+        (4,16),
+        (5,16),
+        (6,16),
+        (7,14),
+        (7,15),
+        (7,17),
+        (8,15),
+        (4,9),
+        (5,9),
+        (6,9),
+        (7,9),
+        (2,24),
+        (2,25),
+        (2,26),
+        (2,6),
+        (7,12),
+        (1,29),
+        (7,30),
+        (9,4),
+        (4,5),
+        (5,5),
+        (6,5),
+        (8,12),
+        (1,27),
+        (1,28),
+        (7,32),
+        (7,31),
+        (2,33),
+        (4,33),
+        (5,33),
+        (6,33),
+        (6,34),
+        (2,35);
+
+    END;
+  END IF;
+END;
+$$
+LANGUAGE plpgsql;

apps/backend/package.json

@@ -35,6 +35,7 @@
   "dependencies": {
     "@apollo/server": "^4.10.0",
     "@apollo/subgraph": "^2.7.1",
+    "@casl/ability": "^6.8.0",
     "@graphql-tools/utils": "^10.1.0",
     "@isaacs/ttlcache": "^1.4.1",
     "@opentelemetry/exporter-trace-otlp-http": "^0.200.0",
@@ -46,6 +47,7 @@
     "@opentelemetry/resource-detector-container": "^0.7.0",
     "@opentelemetry/sdk-node": "^0.200.0",
     "@opentelemetry/sdk-trace-node": "^2.0.0",
+    "@ucast/sql": "^0.1.0",
     "@user-office-software/duo-localisation": "^1.2.0",
     "@user-office-software/duo-logger": "^2.3.2",
     "@user-office-software/duo-message-broker": "^1.8.0",

apps/backend/src/auth/FapAuthorization.ts

@@ -0,0 +1,27 @@
+import { inject, injectable } from 'tsyringe';
+import { Tokens } from '../config/Tokens';
+import { PermissionDataSource } from '../datasources/PermissionDataSource';
+import { UserWithRole } from '../models/User';
+import { FapDataSource } from '../datasources/FapDataSource';
+
+@injectable()
+export class FapAuthorization {
+  constructor(
+    @inject(Tokens.FapDataSource)
+    private fapDataSource: FapDataSource,
+    @inject(Tokens.PermissionDataSource)
+    private permissionDataSource: PermissionDataSource
+  ) {}
+
+  async canEdit(agent: UserWithRole | null, fapId: number) {
+    const fap = await this.fapDataSource.getFap(fapId);
+
+    const user = {
+      role: agent?.currentRole?.shortCode,
+      userId: agent?.id,
+    };
+
+    const ctx = {fap, user}
+    return this.permissionDataSource.hasPermission(user.role ? user.role : 'user', 'update', 'fap', false, ctx);
+  }
+}

apps/backend/src/auth/ProposalAuthorization.ts

@@ -15,6 +15,7 @@ import { Proposal } from '../resolvers/types/Proposal';
 import { UserDataSource } from './../datasources/UserDataSource';
 import { UserJWT } from './../models/User';
 import { UserAuthorization } from './UserAuthorization';
+import { PermissionDataSource } from '../datasources/PermissionDataSource';
 
 @injectable()
 export class ProposalAuthorization {
@@ -35,7 +36,9 @@ export class ProposalAuthorization {
     private statusDataSource: StatusDataSource,
     @inject(Tokens.DataAccessUsersDataSource)
     private dataAccessUsersDataSource: DataAccessUsersDataSource,
-    @inject(Tokens.UserAuthorization) protected userAuth: UserAuthorization
+    @inject(Tokens.UserAuthorization) protected userAuth: UserAuthorization,
+    @inject(Tokens.PermissionDataSource)
+    private permissionDataSource: PermissionDataSource
   ) {}
 
   private async resolveProposal(
@@ -258,50 +261,45 @@ export class ProposalAuthorization {
 
     const currentRole = agent?.currentRole?.shortCode;
 
-    let hasAccess = false;
+    let permissionContext: any = null;
+    let isApiKey = false;
 
+    //I kept the switch statement with explicit reference to roles in order to avoid having to gather all the properties
+    //in a single context object, which would affect performance
     switch (currentRole) {
       case Roles.USER:
-        hasAccess =
-          (await this.isMemberOfProposal(agent, proposal)) ||
-          (await this.isVisitorOfProposal(agent, proposal.primaryKey)) ||
-          (await this.isDataAccessUserOfProposal(agent, proposal.primaryKey));
+        permissionContext = {
+          isMemberOfProposal: await this.isMemberOfProposal(agent, proposal),
+          isVisitorOfProposal: await this.isVisitorOfProposal(agent, proposal.primaryKey),
+          isDataAccessUserOfProposal: await this.isDataAccessUserOfProposal(agent, proposal.primaryKey)
+        };
         break;
       case Roles.INSTRUMENT_SCIENTIST:
-        hasAccess =
-          (await this.isInstrumentManagerToProposal(
-            agent,
-            proposal.primaryKey
-          )) ||
-          (await this.isScientistToProposal(agent, proposal.primaryKey)) ||
-          (await this.isScientistToProposalTechnique(
-            agent,
-            proposal.primaryKey
-          ));
+        permissionContext = {
+          isInstrumentManagerToProposal: await this.isInstrumentManagerToProposal(agent, proposal.primaryKey),
+          isScientistToProposal: await this.isScientistToProposal(agent, proposal.primaryKey),
+          isScientistToProposalTechnique: await this.isScientistToProposalTechnique(agent, proposal.primaryKey)
+        };
         break;
       case Roles.INTERNAL_REVIEWER:
-        hasAccess = await this.isInternalReviewer(agent, proposal.primaryKey);
+        permissionContext = {
+          isInternalReviewer: await this.isInternalReviewer(agent, proposal.primaryKey)
+        };
         break;
       case Roles.FAP_REVIEWER:
       case Roles.FAP_SECRETARY:
       case Roles.FAP_CHAIR:
-        hasAccess = await this.isMemberOfFapProposal(
-          agent,
-          proposal.primaryKey
-        );
+        permissionContext = {
+          isMemberOfFapProposal: this.isMemberOfFapProposal(agent, proposal.primaryKey)
+        };
         break;
       case Roles.USER_OFFICER:
-        hasAccess = true;
-        break;
       case Roles.EXPERIMENT_SAFETY_REVIEWER:
-        hasAccess = true;
         break;
-
       default:
-        hasAccess = this.userAuth.hasGetAccessByToken(agent);
+        isApiKey = true;
     }
-
-    return hasAccess;
+    return isApiKey? this.userAuth.hasGetAccessByToken(agent) : await this.permissionDataSource.hasPermission(currentRole ? currentRole : 'user', 'read', 'proposal', false, permissionContext); //probably need to change
   }
 
   private async isProposalEditable(
@@ -366,4 +364,16 @@ export class ProposalAuthorization {
 
     return false;
   }
+
+  async canDelete(agent: UserWithRole | null, proposalPk: number) {
+    const proposal = await this.proposalDataSource.get(proposalPk);
+
+    const user = {
+      role: agent?.currentRole?.shortCode,
+      userId: agent?.id,
+    };
+
+    const ctx = {proposal, user}
+    return this.permissionDataSource.hasPermission(user.role ? user.role : 'user', 'delete', 'proposal', false, ctx);
+  }
 }