The server Who may do what

Who may do what

ReboFiles has no users of its own. identify says who is asking, from your session; authorize is asked on every route, with the entry it is about.

Who

identify

Given the Request, it returns { id } for someone signed in, or null, answered 401. The id is how the drive names them: owners, shares, activity. admin: true may configure the drive with byRoles.

What

The actions

Action	Asked for
list	What is in a folder; null for the top. Each entry in it is then asked as read.
read	One entry, a search, Recent, the trash, its activity: what a person may see at all.
create	A folder, with the folder it goes into.
upload	A file, with the folder it goes into; a new version, its smaller pictures, its text, with the file. Asked again when it finishes.
rename	The entry renamed, or a folder given a colour.
move	The entry, and then the folder it goes to.
trash, restore	Into the trash, and out of it.
delete	Gone for good: the bytes leave the bucket.
download	An address to read the file from, for a few minutes.
comment	Asked of nothing yet: what a commenter may do beyond a viewer.
share	Sharing it, taking it back, and its links.
configure	The settings of the whole drive. With byRoles, a user identify gives as { id, admin: true }.

Roles

byRoles

From the drive itself: the owner may do everything to an entry and to what is inside it; those it is shared with what their role allows. A viewer looks, reads and downloads; an editor also makes, uploads, renames, moves and puts in the trash; only the owner deletes for good and shares. Anyone signed in may look at the top and put things there; it shows each their own.

Yours

Rules of your own

Ask byRoles from yours. The fourth argument is the whole drive, for rules that look at the folders an entry is in.

lib/auth.ts

import { type Action, type User, byRoles } from '@rebofiles/server';
import type { Drive, Entry } from '@rebofiles/core';

export function mayI(user: User, action: Action, entry: Entry | null, drive: Drive): boolean {
  // Your rules first: an auditor may look at everything, never change it.
  if (isAuditor(user)) return ['list', 'read', 'download'].includes(action);
  return byRoles(user, action, entry, drive);
}

Errors

When it says no

401 is identify returning null; 403 is authorize returning false.

Teams

Groups

createDriveHandler({
  // …
  identify: async (request) => {
    const user = await session(request);
    // The groups your application says they are in: what is shared with "group:sales" is theirs to read.
    return user ? { id: user.id, groups: await groupsOf(user.id) } : null;
  },
  authorize: byRoles,
});

await client.share(folder.id, 'group:sales', 'editor');

A share names someone by their id, everyone signed in as *, or a group as group:<id>. Who is in a group is your application’s, given by identify with each person: the drive keeps no list of members, so a person who joins or leaves a team in your application has, or no longer has, what it was given at their next request. In the dialog of sharing, group:sales is typed as an id is; Shared with me shows what a group of theirs was given.