Initial commit of Descrybe v2 without local scratch artifacts.

Drop one-shot tmp/axe scripts and agent i18n scratch so the Gitea tree is deployable.
2026-08-09 22:47:43 +02:00
commit 8580c996c3
1285 changed files with 325780 additions and 0 deletions
@@ -0,0 +1,71 @@
+import { api, ApiError, failureMessage } from "$lib/api";
+import type { MeResponse, StaffAccess } from "$lib/types";
+
+export type AdminGateResult =
+	| { ok: true; me: MeResponse; staff: StaffAccess }
+	| { ok: false; reason: "auth" | "forbidden" | "error"; message: string };
+
+function resolveStaff(me: MeResponse): StaffAccess {
+	if (me.staff_access) {
+		return {
+			staff_role: me.staff_access.staff_role,
+			full_admin: Boolean(me.staff_access.full_admin),
+			support_desk: Boolean(me.staff_access.support_desk),
+			is_support_only: Boolean(me.staff_access.is_support_only)
+		};
+	}
+	// Legacy fallback when staff_access is absent (pre-migration clients).
+	const full = Boolean(me.user?.is_platform_admin);
+	return {
+		full_admin: full,
+		support_desk: full,
+		is_support_only: false
+	};
+}
+
+export async function requirePlatformAdmin(): Promise<AdminGateResult> {
+	try {
+		const me = await api<MeResponse>("/api/auth/me");
+		const staff = resolveStaff(me);
+		if (!staff.full_admin) {
+			return { ok: false, reason: "forbidden", message: "Platform admin required." };
+		}
+		return { ok: true, me, staff };
+	} catch (err) {
+		if (err instanceof ApiError && err.status === 401) {
+			return { ok: false, reason: "auth", message: "Authentication required." };
+		}
+		if (err instanceof ApiError && err.status === 403) {
+			return { ok: false, reason: "forbidden", message: "Platform admin required." };
+		}
+		return {
+			ok: false,
+			reason: "error",
+			message: failureMessage(err, "Failed to verify admin access")
+		};
+	}
+}
+
+/** Full admin or support_staff — for /admin/support desk pages. */
+export async function requireSupportDesk(): Promise<AdminGateResult> {
+	try {
+		const me = await api<MeResponse>("/api/auth/me");
+		const staff = resolveStaff(me);
+		if (!staff.support_desk) {
+			return { ok: false, reason: "forbidden", message: "Support desk access required." };
+		}
+		return { ok: true, me, staff };
+	} catch (err) {
+		if (err instanceof ApiError && err.status === 401) {
+			return { ok: false, reason: "auth", message: "Authentication required." };
+		}
+		if (err instanceof ApiError && err.status === 403) {
+			return { ok: false, reason: "forbidden", message: "Support desk access required." };
+		}
+		return {
+			ok: false,
+			reason: "error",
+			message: failureMessage(err, "Failed to verify support access")
+		};
+	}
+}