@visense/access-control-definitions

Single source of truth for permissions, roles, and role-permission mappings across Visense apps.

Install

pnpm add @visense/access-control-definitions

Usage

Types and constants (zero dependencies)

import {
    Apps,
    type InnsiktPermissionKey,
    type AppDefinition,
} from '@visense/access-control-definitions'

const { Innsikt } = Apps

// Named permission key map — no hardcoded strings
if (userPerms.includes(Innsikt.Permissions.TILBUD_WRITE)) {
    // Show the create-offer button
}

// Compile-time safe permission check
function hasPermission(perm: InnsiktPermissionKey) {
    /* … */
}
hasPermission('eiendommer:read') // ✓
hasPermission('bogus') // ✗ TypeScript error

Sync to database

The sync script lives in the access-control-api app and upserts all permissions, roles, and role-permission mappings to the database. Apps must already exist in the DB (created via the API or db-init).

# From the access-control-api directory
pnpm db:sync

Adding a new permission

Add a new entry to the P map in src/innsikt.ts (PERMISSIONS is derived automatically via Object.values(P)), then assign the permission to the relevant roles in the ROLES array. Run pnpm test:unit to validate.

Adding a new role

Add a new entry to the ROLES array in src/innsikt.ts with a unique key, name, and its permissions list. The satisfies check ensures all referenced permissions are valid.

Adding a new app

1. Create src/<app-name>.ts following the same pattern as src/innsikt.ts
2. Export it from src/index.ts, add it to the Apps object and ALL_APPS
3. Run pnpm test:unit — the manifest tests cover all apps automatically

Scripts

| Command | Description | | ---------------- | ----------------------------------------------- | | pnpm build | Compile TypeScript to dist/ with declarations | | pnpm test:unit | Run manifest validation tests |