exporting ECB

web/src/authz.rs

@@ -7,6 +7,12 @@ pub(crate) const STRUCT_VALIDATION: &str = "struct:validation";
 pub(crate) const STRUCT_ROLE: &str = "struct:role";
 pub(crate) const STRUCT_USER: &str = "struct:user";
 pub(crate) const MANAGE: &str = "manage";
+pub(crate) const READ: &str = "read";
+
+/// Every ECB object, which is what the pipeline status is checked against:
+/// one importer feeds every profile, so reading its health is not a
+/// per-profile question.
+pub(crate) const ALL_ECB: &str = "ecb:*";
 
 pub(crate) fn permits(snapshot: &AuthorizationSnapshot, object: &str, action: &str) -> bool {
     permissions_permit(&snapshot.permissions, object, action)
@@ -26,6 +32,12 @@ pub(crate) fn can_manage(snapshot: &AuthorizationSnapshot, area: &str) -> bool {
     permits(snapshot, area, MANAGE)
 }
 
+/// Whether the caller may see the reference-rate pipeline. Mirrors the
+/// server's own check in `server/src/ecb/grpc.rs`.
+pub(crate) fn can_read_ecb(snapshot: &AuthorizationSnapshot) -> bool {
+    permits(snapshot, ALL_ECB, READ)
+}
+
 pub(crate) fn can_open_admin(snapshot: &AuthorizationSnapshot) -> bool {
     [
         STRUCT_PROFILE,