web synchronized with the new changes

web/src/ui/mod.rs

@@ -15,6 +15,9 @@ pub(crate) const SESSION_COOKIE: &str = "analytics_token";
 pub(crate) struct Nav {
     pub authenticated: bool,
     pub role: String,
+    pub can_admin: bool,
+    pub can_import: bool,
+    pub can_export: bool,
     pub active: &'static str,
 }
 
@@ -25,14 +28,25 @@ impl Nav {
         Self {
             authenticated: crate::cookie_value(headers, SESSION_COOKIE).is_some(),
             role: String::new(),
+            can_admin: false,
+            can_import: false,
+            can_export: false,
             active,
         }
     }
 
-    /// The admin page is the only one that learns the caller's role, so it is
-    /// the only one that can show the role badge.
-    pub(crate) fn with_role(mut self, role: String) -> Self {
-        self.role = role;
+    pub(crate) fn with_authorization(
+        mut self,
+        authorization: &crate::auth::AuthorizationSnapshot,
+    ) -> Self {
+        self.role = authorization.role.clone();
+        self.can_admin = crate::authz::can_open_admin(authorization);
+        self.can_import = authorization.permissions.iter().any(|permission| {
+            permission.action == "insert" && permission.object.starts_with("data:")
+        });
+        self.can_export = authorization.permissions.iter().any(|permission| {
+            permission.action == "read" && permission.object.starts_with("data:")
+        });
         self
     }
 }
@@ -42,6 +56,9 @@ impl Default for Nav {
         Self {
             authenticated: false,
             role: String::new(),
+            can_admin: false,
+            can_import: false,
+            can_export: false,
             active: "",
         }
     }