Basic rights/roles about fublog

[floscher]

@fumiX/entwickler We have the basic set of permissions as described above:

fuBlog/common/src/entity/permission/UserRolePermissions.ts

Lines 1 to 21 in f52b582

	export type UserRolePermissionsType = {
	/**
	* This is `true` when the user is allowed to give any user additional permissions,
	* and also remove their current permissions. Otherwise: `false`.
	*/
	canEditUserRoles: boolean;
	/**
	* This is `true` when the user is allowed to create a new blogpost.
	* They are additionally allowed to edit those posts, which they created themselves.
	* Otherwise: `false`.
	*/
	canCreatePost: boolean;
	/**
	* This is `true` when the user is allowed to edit any blogpost. Otherwise: `false`.
	*/
	canEditPost: boolean;
	/**
	* This is `true` when the user is allowed to delete any blogpost. Otherwise: `false`.
	*/
	canDeletePost: boolean;
	};

At the moment we also have four roles that each give the user exactly one of these four permissions:

fuBlog/common/src/entity/UserRole.ts

Lines 14 to 31 in f52b582

	export const UserRoles: UserRolesType = {
	ADMIN: new UserRolePermissions(
	"Can change roles of all users", //
	{ canEditUserRoles: true },
	),
	POST_CREATE: new UserRolePermissions(
	"Can create a new post and also edit their own posts", //
	{ canCreatePost: true },
	),
	POST_EDIT: new UserRolePermissions(
	"Can edit any existing post", //
	{ canEditPost: true },
	),
	POST_DELETE: new UserRolePermissions(
	"Can delete any existing post", //
	{ canDeletePost: true },
	),
	} as const;

Now these roles were just meant as a placeholder for a more sensible set of roles. I'd propose these ones:

• Admin: all permissions (as soon as a user has canEditUserRoles, they could assign themselves any other role anyway)
• Writer: canCreatePost
• Editor: canEditPost, canDeletePost

Any comments on this, or other suggestions?

---

Sidenote: The concept for saving is as follows: In the user table an array of roles is persisted for each user. Both client and server are (without network calls) capable of converting a set of roles into a permission object, which has boolean attributes for what a user with that combination of roles is allowed to do.