cw2007/move_detect
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(cloud): RBAC permission matrix

Browse source
This commit is contained in:
유창욱 2026-07-12 00:19:47 +09:00
parent 76ea1b4ecf
commit 9983bc8fe3
2 changed files with 43 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
cloud/src/Auth/Rbac.php Normal file
View file

@ -0,0 +1,15 @@
<?php
declare(strict_types=1);
namespace App\Auth;
final class Rbac
{
private const MATRIX = [
'admin' => ['view_events','acknowledge','edit_zones','manage_thresholds','manage_compliance'],
'operator' => ['view_events','acknowledge','edit_zones'],
'viewer' => ['view_events'],
];
public static function can(string $role, string $permission): bool {
return in_array($permission, self::MATRIX[$role] ?? [], true);
}
}

28
cloud/tests/RbacTest.php Normal file
View file

@ -0,0 +1,28 @@
<?php
declare(strict_types=1);
namespace App\Tests;
use App\Auth\Rbac;
use PHPUnit\Framework\TestCase;
final class RbacTest extends TestCase
{
public function testViewerCanOnlyView(): void {
$this->assertTrue(Rbac::can('viewer', 'view_events'));
$this->assertFalse(Rbac::can('viewer', 'acknowledge'));
$this->assertFalse(Rbac::can('viewer', 'edit_zones'));
}
public function testOperator(): void {
$this->assertTrue(Rbac::can('operator', 'acknowledge'));
$this->assertTrue(Rbac::can('operator', 'edit_zones'));
$this->assertFalse(Rbac::can('operator', 'manage_thresholds'));
}
public function testAdminAll(): void {
foreach (['view_events','acknowledge','edit_zones','manage_thresholds','manage_compliance'] as $p) {
$this->assertTrue(Rbac::can('admin', $p));
}
}
public function testUnknownDenied(): void {
$this->assertFalse(Rbac::can('ghost', 'view_events'));
$this->assertFalse(Rbac::can('admin', 'unknown_perm'));
}
}