breaking

server/core/acl.js

@@ -0,0 +1,47 @@
+/**
+ * Capability / role ACL for peardock RPC.
+ *
+ * Default: every peer is admin (backward compatible).
+ * Set PEARDOCK_DEFAULT_ROLE=viewer|operator|admin to tighten.
+ * Set PEARDOCK_ADMIN_KEYS=hex,hex to force those peers to admin and others to default.
+ */
+import { Roles, roleAllows, MethodRoles } from '../../shared/protocol.js'
+
+const DEFAULT_ROLE = (process.env.PEARDOCK_DEFAULT_ROLE || Roles.admin).toLowerCase()
+const ADMIN_KEYS = new Set(
+  (process.env.PEARDOCK_ADMIN_KEYS || '')
+    .split(',')
+    .map((s) => s.trim().toLowerCase())
+    .filter(Boolean)
+)
+
+/**
+ * Resolve role for a peer public key hex.
+ * @param {string} peerIdHex
+ * @returns {string}
+ */
+export function resolveRole(peerIdHex) {
+  const id = (peerIdHex || '').toLowerCase()
+  if (ADMIN_KEYS.size > 0) {
+    return ADMIN_KEYS.has(id) ? Roles.admin : DEFAULT_ROLE === Roles.admin ? Roles.operator : DEFAULT_ROLE
+  }
+  if ([Roles.viewer, Roles.operator, Roles.admin].includes(DEFAULT_ROLE)) {
+    return DEFAULT_ROLE
+  }
+  return Roles.admin
+}
+
+/**
+ * @param {string} role
+ * @param {string} method
+ */
+export function assertAllowed(role, method) {
+  if (!roleAllows(role, method)) {
+    const need = MethodRoles[method] || Roles.admin
+    const err = new Error(`Permission denied: ${method} requires role "${need}" (have "${role}")`)
+    err.code = 'PERMISSION_DENIED'
+    throw err
+  }
+}
+
+export { Roles }