Adding SuperAdmin alternative check for creating entitlements

Author: simonredfern

src/lib/utils/roleChecker.ts

@@ -123,6 +123,11 @@ export const ROLE_REQUIREMENTS = {
   ],
 
   createEntitlement: [
+    {
+      role: "SuperAdmin",
+      description: "Super administrator with all permissions",
+      action: "create entitlements",
+    },
     {
       role: "CanCreateEntitlementAtAnyBank",
       description: "Create entitlements for users",
@@ -131,6 +136,11 @@ export const ROLE_REQUIREMENTS = {
   ],
 
   deleteEntitlement: [
+    {
+      role: "SuperAdmin",
+      description: "Super administrator with all permissions",
+      action: "delete entitlements",
+    },
     {
       role: "CanDeleteEntitlementAtAnyBank",
       description: "Delete entitlements from users",

src/routes/api/rbac/entitlements/+server.ts

@@ -22,6 +22,26 @@ export const POST: RequestHandler = async ({ request, locals }) => {
     return json({ error: "No API access token available" }, { status: 401 });
   }
 
+  // Check if user has required entitlements
+  const userEntitlements = (session.data.user as any)?.entitlements?.list || [];
+  const hasPermission = userEntitlements.some(
+    (ent: any) =>
+      ent.role_name === "SuperAdmin" ||
+      ent.role_name === "CanCreateEntitlementAtAnyBank" ||
+      ent.role_name === "CanCreateEntitlementAtOneBank",
+  );
+
+  if (!hasPermission) {
+    logger.warn("User does not have permission to create entitlements");
+    return json(
+      {
+        error:
+          "Insufficient permissions. Required: SuperAdmin, CanCreateEntitlementAtAnyBank, or CanCreateEntitlementAtOneBank",
+      },
+      { status: 403 },
+    );
+  }
+
   try {
     const body = await request.json();
     const { user_id, role_name, bank_id } = body;

src/routes/api/rbac/entitlements/[entitlement_id]/+server.ts

@@ -28,6 +28,26 @@ export const DELETE: RequestHandler = async ({ params, locals }) => {
     return json({ error: "No API access token available" }, { status: 401 });
   }
 
+  // Check if user has required entitlements
+  const userEntitlements = (session.data.user as any)?.entitlements?.list || [];
+  const hasPermission = userEntitlements.some(
+    (ent: any) =>
+      ent.role_name === "SuperAdmin" ||
+      ent.role_name === "CanDeleteEntitlementAtAnyBank" ||
+      ent.role_name === "CanDeleteEntitlementAtOneBank",
+  );
+
+  if (!hasPermission) {
+    logger.warn("User does not have permission to delete entitlements");
+    return json(
+      {
+        error:
+          "Insufficient permissions. Required: SuperAdmin, CanDeleteEntitlementAtAnyBank, or CanDeleteEntitlementAtOneBank",
+      },
+      { status: 403 },
+    );
+  }
+
   try {
     logger.info("=== DELETE ENTITLEMENT ===");
     logger.info(`Entitlement ID: ${entitlement_id}`);