import export rbac

web/src/authz.rs

@@ -14,6 +14,9 @@ pub(crate) const READ: &str = "read";
 /// per-profile question.
 pub(crate) const ALL_ECB: &str = "ecb:*";
 
+/// Mirrors `server/src/auth/rbac/roles.rs`.
+pub(crate) const SUPERADMIN: &str = "superadmin";
+
 pub(crate) fn permits(snapshot: &AuthorizationSnapshot, object: &str, action: &str) -> bool {
     permissions_permit(&snapshot.permissions, object, action)
 }
@@ -38,6 +41,14 @@ pub(crate) fn can_read_ecb(snapshot: &AuthorizationSnapshot) -> bool {
     permits(snapshot, ALL_ECB, READ)
 }
 
+/// Whether the caller is the superadmin. Bulk data transfer — CSV import and
+/// export — is theirs alone: it moves whole tables at once, which is the same
+/// reach as the backup they already hold, and a data role's own grants say
+/// nothing about whether it should have that.
+pub(crate) fn is_superadmin(snapshot: &AuthorizationSnapshot) -> bool {
+    snapshot.role == SUPERADMIN
+}
+
 pub(crate) fn can_open_admin(snapshot: &AuthorizationSnapshot) -> bool {
     [
         STRUCT_PROFILE,