web permissions2

web/src/authz.rs

@@ -39,6 +39,21 @@ pub(crate) fn can_open_admin(snapshot: &AuthorizationSnapshot) -> bool {
     .any(|area| can_manage(snapshot, area))
 }
 
+/// The server's authority ranking (`server/src/auth/rbac/roles.rs`), mirrored
+/// so the permission pages only offer what the server will accept: superadmin
+/// outranks admin, admin outranks every data role, and no role outranks itself.
+pub(crate) fn outranks(actor: &str, target: &str) -> bool {
+    rank(actor) > rank(target)
+}
+
+fn rank(role: &str) -> u8 {
+    match role {
+        "superadmin" => 3,
+        "admin" => 2,
+        _ => 1,
+    }
+}
+
 pub(crate) fn table_object(profile: &str, table: &str) -> String {
     format!("data:{profile}/{table}")
 }
@@ -90,6 +105,15 @@ mod tests {
         assert!(!can_manage(&authorization, STRUCT_ROLE));
     }
 
+    #[test]
+    fn nobody_administers_a_peer_or_a_superior() {
+        assert!(outranks("superadmin", "admin"));
+        assert!(outranks("admin", "sales"));
+        assert!(!outranks("admin", "admin"));
+        assert!(!outranks("admin", "superadmin"));
+        assert!(!outranks("sales", "clerk"));
+    }
+
     #[test]
     fn data_wildcards_match_the_server_object_shapes() {
         let global = snapshot(&[("data:*", "read")]);