import export rbac2

web/src/authz.rs

@@ -14,8 +14,14 @@ pub(crate) const READ: &str = "read";
 /// per-profile question.
 pub(crate) const ALL_ECB: &str = "ecb:*";
 
-/// Mirrors `server/src/auth/rbac/roles.rs`.
-pub(crate) const SUPERADMIN: &str = "superadmin";
+/// The two bulk-transfer actions, mirroring
+/// `server/src/auth/rbac/objects.rs`. Taking a whole table out as a file is
+/// its own grant rather than something `read` implies, and loading one in is
+/// its own grant rather than something `insert` implies — so a superadmin can
+/// hand a role the row access without the bulk transfer, or the other way
+/// round.
+pub(crate) const EXPORT: &str = "export";
+pub(crate) const IMPORT: &str = "import";
 
 pub(crate) fn permits(snapshot: &AuthorizationSnapshot, object: &str, action: &str) -> bool {
     permissions_permit(&snapshot.permissions, object, action)
@@ -41,12 +47,15 @@ pub(crate) fn can_read_ecb(snapshot: &AuthorizationSnapshot) -> bool {
     permits(snapshot, ALL_ECB, READ)
 }
 
-/// Whether the caller is the superadmin. Bulk data transfer — CSV import and
-/// export — is theirs alone: it moves whole tables at once, which is the same
-/// reach as the backup they already hold, and a data role's own grants say
-/// nothing about whether it should have that.
-pub(crate) fn is_superadmin(snapshot: &AuthorizationSnapshot) -> bool {
-    snapshot.role == SUPERADMIN
+/// Whether the caller holds a transfer action on any table at all — what the
+/// Import and Export links are shown for. Which tables those are is decided
+/// per table by [`permits_table`], since a grant may name one table, one
+/// profile, or everything.
+pub(crate) fn can_transfer_anything(snapshot: &AuthorizationSnapshot, action: &str) -> bool {
+    snapshot
+        .permissions
+        .iter()
+        .any(|permission| permission.action == action && permission.object.starts_with("data:"))
 }
 
 pub(crate) fn can_open_admin(snapshot: &AuthorizationSnapshot) -> bool {