78 lines
2.6 KiB
Rust
78 lines
2.6 KiB
Rust
//! Portal role model and access-scope contract.
|
|
//!
|
|
//! CONTRACT: role aliases, serialized values and allowed scopes are part of
|
|
//! the portal API/security boundary. Keep changes explicit and covered by
|
|
//! existing role-gate tests in `main.rs`.
|
|
|
|
use serde::Serialize;
|
|
|
|
#[derive(Clone, Copy, Debug, Eq, PartialEq, Serialize)]
|
|
#[serde(rename_all = "snake_case")]
|
|
pub(crate) enum PortalRole {
|
|
Executive,
|
|
Manager,
|
|
Security,
|
|
Forensics,
|
|
Admin,
|
|
}
|
|
|
|
impl PortalRole {
|
|
pub(crate) fn parse(value: &str) -> Option<Self> {
|
|
match value.trim().to_ascii_lowercase().as_str() {
|
|
"executive" | "owner" | "rukovoditel" | "руководитель" => {
|
|
Some(Self::Executive)
|
|
}
|
|
"manager" | "workforce" | "руководитель_подразделения" => {
|
|
Some(Self::Manager)
|
|
}
|
|
"security" | "ib" | "soc" | "безопасность" => Some(Self::Security),
|
|
"forensics" | "investigation" | "расследования" => Some(Self::Forensics),
|
|
"admin" | "operations" | "operator" | "эксплуатация" => Some(Self::Admin),
|
|
_ => None,
|
|
}
|
|
}
|
|
|
|
pub(crate) fn as_str(self) -> &'static str {
|
|
match self {
|
|
Self::Executive => "executive",
|
|
Self::Manager => "manager",
|
|
Self::Security => "security",
|
|
Self::Forensics => "forensics",
|
|
Self::Admin => "admin",
|
|
}
|
|
}
|
|
|
|
pub(crate) fn label_ru(self) -> &'static str {
|
|
match self {
|
|
Self::Executive => "Руководитель",
|
|
Self::Manager => "Руководитель подразделения",
|
|
Self::Security => "Безопасность",
|
|
Self::Forensics => "Расследования",
|
|
Self::Admin => "Администратор",
|
|
}
|
|
}
|
|
|
|
pub(crate) fn allowed_scopes(self) -> &'static [&'static str] {
|
|
match self {
|
|
Self::Executive => &["executive", "workforce"],
|
|
Self::Manager => &["executive", "workforce"],
|
|
Self::Security => &["security", "incidents", "ueba", "pfsense"],
|
|
Self::Forensics => &["forensics", "incidents", "ueba"],
|
|
Self::Admin => &[
|
|
"executive",
|
|
"workforce",
|
|
"security",
|
|
"forensics",
|
|
"incidents",
|
|
"ueba",
|
|
"pfsense",
|
|
"admin",
|
|
],
|
|
}
|
|
}
|
|
|
|
pub(crate) fn can_access(self, scope: &str) -> bool {
|
|
self.allowed_scopes().contains(&scope)
|
|
}
|
|
}
|