hyb-oa/server/src/constants/permissions.js

const EMPLOYEE_BASE_PERMISSIONS = [
  "expense.create",
  "expense.view_own",
  "expense.edit_own",
  "expense.delete_own",
  "expense.submit",
  "expense.withdraw",
  "invoice.upload",
  "invoice.view_own",
  "expense.proxy_manage",
];

const ROLE_PERMISSIONS = {
  employee: EMPLOYEE_BASE_PERMISSIONS,
  manager: [...EMPLOYEE_BASE_PERMISSIONS, "expense.approve", "expense.transfer", "expense.view_all"],
  ceo: [...EMPLOYEE_BASE_PERMISSIONS, "expense.approve", "expense.transfer", "expense.view_all"],
  finance: [
    ...EMPLOYEE_BASE_PERMISSIONS,
    "invoice.manage",
    "expense.approve",
    "expense.finance.pay",
    "expense.view_all",
  ],
  finance_mgr: [
    ...EMPLOYEE_BASE_PERMISSIONS,
    "invoice.manage",
    "expense.approve",
    "expense.finance.pay",
    "expense.view_all",
    "expense.finance.override_duplicate",
    "system.settings",
  ],
  administration: ["expense.proxy_submit", "expense.view_own"],
  hr: ["system.users", "expense.view_all"],
  admin: ["*"],
};

function getRolePermissions(roleCode) {
  return ROLE_PERMISSIONS[roleCode] ?? [];
}

function resolvePermissionsForRoles(roleCodes) {
  const permissions = new Set();

  for (const roleCode of roleCodes ?? []) {
    for (const permission of getRolePermissions(roleCode)) {
      permissions.add(permission);
    }
  }

  return Array.from(permissions);
}

function hasPermission(permissionCodes, permission) {
  return permissionCodes.includes("*") || permissionCodes.includes(permission);
}

module.exports = {
  ROLE_PERMISSIONS,
  resolvePermissionsForRoles,
  hasPermission,
};