@@ -218,6 +218,7 @@ export const rowLevelSecurityRules: Permission.RowLevelSecurityPolicy[] = [
218218 object : 'opportunity' ,
219219 description : 'Users can only access their own opportunities' ,
220220 operation : 'select' ,
221+ priority : 100 ,
221222
222223 // USING clause - Filter condition
223224 using : `owner_id = current_user.id OR territory IN (SELECT id FROM territories WHERE user_id = current_user.id) OR owner_manager_id = current_user.id` ,
@@ -233,6 +234,7 @@ export const rowLevelSecurityRules: Permission.RowLevelSecurityPolicy[] = [
233234 object : 'account' ,
234235 description : 'Territory-based account access' ,
235236 operation : 'select' ,
237+ priority : 100 ,
236238
237239 using : `territory IN (SELECT id FROM territories WHERE user_id = current_user.id) AND status = 'active'` ,
238240
@@ -318,50 +320,35 @@ export const territories: Permission.Territory[] = [
318320 {
319321 name : 'north_america' ,
320322 label : 'North America' ,
321- description : 'North American sales territory' ,
323+ modelId : 'global_sales_territories' ,
324+ type : 'geography' ,
322325
323- // Territory definition
324- criteria : {
325- operator : 'OR' ,
326- conditions : [
327- {
328- field : 'billing_country' ,
329- operator : 'in' ,
330- value : [ 'USA' , 'Canada' , 'Mexico' ] ,
331- } ,
332- ] ,
333- } ,
326+ // Territory assignment rule
327+ assignmentRule : `billing_country IN ('USA', 'Canada', 'Mexico')` ,
334328
335329 // Assigned users
336- members : [ 'user_002' , 'user_003' ] ,
330+ assignedUsers : [ 'user_002' , 'user_003' ] ,
337331
338- // Parent territory (for hierarchy)
339- parentTerritory : undefined ,
332+ // Access levels
333+ accountAccess : 'edit' ,
334+ opportunityAccess : 'edit' ,
335+ caseAccess : 'read' ,
340336 } ,
341337
342338 {
343339 name : 'west_coast' ,
344340 label : 'West Coast' ,
345- description : 'US West Coast territory' ,
341+ modelId : 'global_sales_territories' ,
342+ type : 'geography' ,
343+ parent : 'north_america' ,
346344
347- criteria : {
348- operator : 'AND' ,
349- conditions : [
350- {
351- field : 'billing_country' ,
352- operator : 'equals' ,
353- value : 'USA' ,
354- } ,
355- {
356- field : 'billing_state' ,
357- operator : 'in' ,
358- value : [ 'CA' , 'OR' , 'WA' , 'NV' , 'AZ' ] ,
359- } ,
360- ] ,
361- } ,
345+ assignmentRule : `billing_country = 'USA' AND billing_state IN ('CA', 'OR', 'WA', 'NV', 'AZ')` ,
346+
347+ assignedUsers : [ 'user_003' ] ,
362348
363- members : [ 'user_003' ] ,
364- parentTerritory : 'north_america' ,
349+ accountAccess : 'edit' ,
350+ opportunityAccess : 'edit' ,
351+ caseAccess : 'read' ,
365352 } ,
366353] ;
367354
@@ -404,11 +391,11 @@ export class PermissionChecker {
404391 /**
405392 * Check if user can access a specific record (RLS)
406393 */
407- canAccessRecord ( user : Auth . User , object : string , record : any ) : boolean {
394+ canAccessRecord ( user : Auth . User & { roles ?: string [ ] } , object : string , record : any ) : boolean {
408395 // Apply RLS rules for user's roles
409396 const userRoles = user . roles || [ ] ;
410397 const applicableRules = rowLevelSecurityRules . filter (
411- ( rls ) => rls . object === object && rls . roles ?. some ( ( r ) => userRoles . includes ( r ) )
398+ ( rls ) => rls . object === object && rls . roles ?. some ( ( r : string ) => userRoles . includes ( r ) )
412399 ) ;
413400
414401 // If no RLS rules, check base permissions
@@ -418,7 +405,7 @@ export class PermissionChecker {
418405
419406 // Evaluate RLS rules
420407 for ( const rule of applicableRules ) {
421- if ( this . evaluateRule ( rule . rule , record , user ) ) {
408+ if ( this . evaluateRule ( rule . using , record , user ) ) {
422409 return true ;
423410 }
424411 }
@@ -429,7 +416,7 @@ export class PermissionChecker {
429416 /**
430417 * Evaluate a rule against a record
431418 */
432- private evaluateRule ( rule : any , record : any , user : Auth . User ) : boolean {
419+ private evaluateRule ( rule : any , record : any , user : Auth . User & { roles ?: string [ ] } ) : boolean {
433420 // Simplified evaluation logic
434421 // In real implementation, evaluate all conditions with operators
435422 return true ;
@@ -440,7 +427,7 @@ export class PermissionChecker {
440427 * Example 8: Usage Demonstration
441428 */
442429export function demonstratePermissions ( ) {
443- const user = sampleUsers [ 2 ] ; // Sales Rep
430+ const user = { ... sampleUsers [ 2 ] , roles : [ 'sales_rep' ] } ; // Sales Rep with role
444431 const checker = new PermissionChecker ( ) ;
445432
446433 console . log ( '=== Permission Check Demo ===\n' ) ;
0 commit comments