Enhance API with OIDC support, including login and callback endpoints. Update environment variables for OIDC configuration in .env.example. Add new features to the catalog service for listing software families, Minecraft versions, and deployment regions. Implement server management actions such as kill, delete, and update in the servers module. Integrate feature flags for maintenance mode in server operations. Update pnpm-lock.yaml with new dependencies and versions.

packages/permissions/package.json

@@ -0,0 +1,17 @@
+{
+  "name": "@hexahost/permissions",
+  "version": "0.0.0",
+  "private": true,
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "scripts": {
+    "build": "tsc",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
+  },
+  "devDependencies": {
+    "@hexahost/typescript-config": "workspace:*",
+    "typescript": "^5.7.3",
+    "vitest": "^3.0.5"
+  }
+}

packages/permissions/src/index.ts

@@ -0,0 +1,134 @@
+export type ServerPermission =
+  | 'server.view'
+  | 'server.start'
+  | 'server.stop'
+  | 'server.restart'
+  | 'server.kill'
+  | 'server.console.view'
+  | 'server.console.command'
+  | 'server.files.view'
+  | 'server.files.edit'
+  | 'server.files.upload'
+  | 'server.files.download'
+  | 'server.files.delete'
+  | 'server.software.change'
+  | 'server.addons.manage'
+  | 'server.worlds.manage'
+  | 'server.players.manage'
+  | 'server.backups.view'
+  | 'server.backups.create'
+  | 'server.backups.restore'
+  | 'server.backups.delete'
+  | 'server.schedules.manage'
+  | 'server.members.manage'
+  | 'server.billing.view'
+  | 'server.delete';
+
+export type ServerMemberRole =
+  | 'OWNER'
+  | 'ADMIN'
+  | 'OPERATOR'
+  | 'DEVELOPER'
+  | 'VIEWER';
+
+const ROLE_PERMISSIONS: Record<ServerMemberRole, ServerPermission[]> = {
+  OWNER: [
+    'server.view',
+    'server.start',
+    'server.stop',
+    'server.restart',
+    'server.kill',
+    'server.console.view',
+    'server.console.command',
+    'server.files.view',
+    'server.files.edit',
+    'server.files.upload',
+    'server.files.download',
+    'server.files.delete',
+    'server.software.change',
+    'server.addons.manage',
+    'server.worlds.manage',
+    'server.players.manage',
+    'server.backups.view',
+    'server.backups.create',
+    'server.backups.restore',
+    'server.backups.delete',
+    'server.schedules.manage',
+    'server.members.manage',
+    'server.billing.view',
+    'server.delete',
+  ],
+  ADMIN: [
+    'server.view',
+    'server.start',
+    'server.stop',
+    'server.restart',
+    'server.kill',
+    'server.console.view',
+    'server.console.command',
+    'server.files.view',
+    'server.files.edit',
+    'server.files.upload',
+    'server.files.download',
+    'server.files.delete',
+    'server.software.change',
+    'server.addons.manage',
+    'server.worlds.manage',
+    'server.players.manage',
+    'server.backups.view',
+    'server.backups.create',
+    'server.backups.restore',
+    'server.members.manage',
+    'server.billing.view',
+  ],
+  OPERATOR: [
+    'server.view',
+    'server.start',
+    'server.stop',
+    'server.restart',
+    'server.console.view',
+    'server.console.command',
+    'server.players.manage',
+    'server.backups.view',
+  ],
+  DEVELOPER: [
+    'server.view',
+    'server.console.view',
+    'server.console.command',
+    'server.files.view',
+    'server.files.edit',
+    'server.files.upload',
+    'server.files.download',
+    'server.addons.manage',
+    'server.worlds.manage',
+    'server.backups.view',
+    'server.backups.create',
+  ],
+  VIEWER: ['server.view', 'server.console.view', 'server.files.view', 'server.backups.view'],
+};
+
+export function permissionsForRole(role: ServerMemberRole): ServerPermission[] {
+  return ROLE_PERMISSIONS[role];
+}
+
+export function hasPermission(
+  role: ServerMemberRole,
+  permission: ServerPermission,
+  overrides?: ServerPermission[] | null,
+): boolean {
+  if (overrides?.includes(permission)) {
+    return true;
+  }
+
+  return ROLE_PERMISSIONS[role].includes(permission);
+}
+
+export function assertPermission(
+  role: ServerMemberRole,
+  permission: ServerPermission,
+  overrides?: ServerPermission[] | null,
+): void {
+  if (!hasPermission(role, permission, overrides)) {
+    throw new Error(`Missing permission: ${permission}`);
+  }
+}

packages/permissions/src/permissions.test.ts

@@ -0,0 +1,19 @@
+import { describe, expect, it } from 'vitest';
+
+import { hasPermission, permissionsForRole } from './index';
+
+describe('permissions', () => {
+  it('grants owner full access', () => {
+    expect(hasPermission('OWNER', 'server.delete')).toBe(true);
+    expect(permissionsForRole('OWNER')).toContain('server.kill');
+  });
+
+  it('restricts viewer to read-only', () => {
+    expect(hasPermission('VIEWER', 'server.start')).toBe(false);
+    expect(hasPermission('VIEWER', 'server.view')).toBe(true);
+  });
+
+  it('honors explicit overrides', () => {
+    expect(hasPermission('VIEWER', 'server.start', ['server.start'])).toBe(true);
+  });
+});

packages/permissions/tsconfig.json

@@ -0,0 +1,8 @@
+{
+  "extends": "@hexahost/typescript-config/library.json",
+  "compilerOptions": {
+    "outDir": "./dist",
+    "rootDir": "./src"
+  },
+  "include": ["src/**/*"]
+}