821675ab4a
Specs stay at repo root (cross-VM). Move deploy and code into logical projects with README per domain, updated manifest.yaml, and symlinks at legacy paths for VM122 backward compatibility.
108 lines
2.7 KiB
Python
108 lines
2.7 KiB
Python
"""RBAC helpers for Ligbox Ops Desk."""
|
|
|
|
from __future__ import annotations
|
|
|
|
ROLES = frozenset({"super_admin", "ops_lead", "technician", "noc"})
|
|
|
|
ROLE_LABELS = {
|
|
"super_admin": "Super Admin",
|
|
"ops_lead": "Chefe Ops",
|
|
"technician": "Suporte",
|
|
"noc": "NOC",
|
|
}
|
|
|
|
|
|
def can_read_tickets(role: str) -> bool:
|
|
return role in ROLES
|
|
|
|
|
|
def can_patch_ticket(role: str, ticket: dict, username: str) -> bool:
|
|
if role in ("super_admin", "ops_lead"):
|
|
return True
|
|
if role == "technician":
|
|
assignee = ticket.get("assigned_to")
|
|
return assignee is None or assignee == username
|
|
return False
|
|
|
|
|
|
def can_assign_ticket(role: str, assignee: str | None, username: str) -> bool:
|
|
if role in ("super_admin", "ops_lead"):
|
|
return True
|
|
if role == "technician":
|
|
return assignee in (None, username)
|
|
return False
|
|
|
|
|
|
def can_run_audit(role: str) -> bool:
|
|
return role in ("super_admin", "ops_lead")
|
|
|
|
|
|
def can_read_audit_overview(role: str) -> bool:
|
|
return role in ("super_admin", "ops_lead", "noc")
|
|
|
|
|
|
def can_read_audit_scorecard(role: str) -> bool:
|
|
return role in ("super_admin", "ops_lead", "noc")
|
|
|
|
|
|
def can_read_cloudflare_dns(role: str) -> bool:
|
|
return role in ("super_admin", "ops_lead", "technician", "noc")
|
|
|
|
|
|
def can_read_funnel(role: str) -> bool:
|
|
return role in ROLES
|
|
|
|
|
|
def can_read_session_timeline(role: str) -> bool:
|
|
return role in ("super_admin", "ops_lead", "technician")
|
|
|
|
|
|
def can_list_webhook_events(role: str, source: str | None = None) -> bool:
|
|
if role == "noc":
|
|
return source in (None, "wazuh", "vm112-security")
|
|
return role in ROLES
|
|
|
|
|
|
def can_read_crm_leads(role: str) -> bool:
|
|
return role in ("super_admin", "ops_lead", "technician")
|
|
|
|
|
|
def can_read_assist(role: str) -> bool:
|
|
return role in ROLES
|
|
|
|
|
|
def can_assist_takeover(role: str) -> bool:
|
|
return role in ("super_admin", "ops_lead", "technician")
|
|
|
|
|
|
def can_assist_handoff(role: str, username: str) -> bool:
|
|
return role in ("super_admin", "ops_lead", "technician")
|
|
|
|
|
|
def can_manage_users(role: str) -> bool:
|
|
return role == "super_admin"
|
|
|
|
|
|
def can_manage_vm112_domains(role: str) -> bool:
|
|
"""Admin Desk — domínios orquestrados VM112 (Spec 017)."""
|
|
return role in ("super_admin", "ops_lead")
|
|
|
|
|
|
def should_mask_sensitive(role: str) -> bool:
|
|
return role == "noc"
|
|
|
|
|
|
def can_read_migration(role: str) -> bool:
|
|
return role in ("super_admin", "ops_lead", "technician", "noc")
|
|
|
|
|
|
def can_manage_migration(role: str) -> bool:
|
|
return role in ("super_admin", "ops_lead", "technician")
|
|
|
|
|
|
def can_read_billing(role: str) -> bool:
|
|
return role in ROLES
|
|
|
|
|
|
def can_manage_billing(role: str) -> bool:
|
|
return role in ("super_admin", "ops_lead")
|