FlowFuse
Granular RBAC: remove hasALowerOrEqualTeamRoleThan and hasAMinimumTeamRoleOf composables
Description
The permissions composable exposes:
hasPermissionhasAMinimumTeamRoleOfhasALowerOrEqualTeamRoleThan
as permissions check utilities.
The latter two don't make use of the permissions model; they encourage hardcoded choices in the front-end code regarding what role is allowed to do something.
Those functions should be removed in favour of hasPermission with the appropriate permissions added to forge/lib/permissions.js.
@cstns WDYT?
Epic/Story
No response
Have you provided an initial effort estimate for this issue?
I have provided an initial effort estimate
I added those checks for semantic purposes only. They don’t add new logic, they just let us write things more clearly in the frontend, the goal was to simplify the code and keep it readable, while still ensuring admin access checks are handled.
It’s true they bypass the permissions model, but they still rely on the same roles that the permissions themselves are based on.
This distinction only makes sense on the frontend, where we need role-based differentiation. The backend only cares about permissions, not roles.
otherwise the syntax would have been:
<component v-if="isVisitingAdmin || (Roles.owner > teamMembership.role") .../>
