first commit

libs/api/tracker/application/src/lib/queries/read-access.ts

@@ -0,0 +1,32 @@
+import { Injectable } from '@nestjs/common';
+import { NotFoundError } from '@task-stream/api/shared/domain';
+import { ProjectRole } from '@task-stream/api/tracker/domain';
+import { FindProjectsRepository } from '../ports/find-projects.repository';
+
+/** Authorisation for the read side, based on the projected memberships. */
+@Injectable()
+export class ReadAccess {
+  constructor(private readonly findProjects: FindProjectsRepository) {}
+
+  async assertCanView(
+    projectId: string,
+    viewerId: string,
+  ): Promise<ProjectRole> {
+    const role = await this.findProjects.findRole(projectId, viewerId);
+    // Same answer for "doesn't exist" and "not yours": don't leak projects.
+    if (!role) throw new NotFoundError('Project', projectId);
+    return role;
+  }
+
+  async canView(projectId: string, viewerId: string): Promise<boolean> {
+    return (await this.findProjects.findRole(projectId, viewerId)) !== null;
+  }
+
+  assertFound<T>(value: T | null, entity: string, id: string): T {
+    if (!value) throw new NotFoundError(entity, id);
+    return value;
+  }
+}
+
+export const UUID =
+  /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;