Phase 8

src/lib/roles/default-permissions.ts

@@ -0,0 +1,56 @@
+import type { PrismaClient } from "@/generated/prisma/client";
+import { Permission } from "@/generated/prisma/enums";
+
+/**
+ * The two system roles' permission sets — single source of truth, used by
+ * both `prisma/seed.ts` (dev/demo fixtures) and the installation wizard
+ * (`src/features/installation/installer.service.ts`, the real "first
+ * owner" creation path). Previously duplicated only in seed.ts; extracted
+ * here in Phase 8 so a permission added to one path can't silently miss
+ * the other (see docs/phase-8-summary.md).
+ */
+export const OWNER_PERMISSIONS: Permission[] = [
+  Permission.MANAGE_BUSINESS_PROFILE,
+  Permission.MANAGE_BOOKING_RULES,
+  Permission.MANAGE_SERVICES,
+  Permission.MANAGE_STAFF,
+  Permission.MANAGE_LOYALTY_PROGRAMME,
+  Permission.MANAGE_NOTIFICATION_SETTINGS,
+  Permission.VIEW_ALL_STAFF_APPOINTMENTS,
+  Permission.MANAGE_ALL_APPOINTMENTS,
+  Permission.MANAGE_OWN_APPOINTMENTS,
+  Permission.CHECK_IN_CUSTOMERS,
+  Permission.MANAGE_LOYALTY_STAMPS,
+  Permission.MANAGE_OWN_AVAILABILITY,
+  Permission.VIEW_CUSTOMER_DIRECTORY,
+  Permission.BOOK_ON_BEHALF_OF_CUSTOMER,
+  Permission.VIEW_REPORTING,
+];
+
+export const BARBER_PERMISSIONS: Permission[] = [
+  Permission.MANAGE_OWN_APPOINTMENTS,
+  Permission.CHECK_IN_CUSTOMERS,
+  Permission.MANAGE_LOYALTY_STAMPS,
+  Permission.MANAGE_OWN_AVAILABILITY,
+  Permission.VIEW_CUSTOMER_DIRECTORY,
+  Permission.BOOK_ON_BEHALF_OF_CUSTOMER,
+];
+
+/**
+ * `role.upsert`'s `update: {}` deliberately does nothing on an existing
+ * role, so a plain nested `permissions: { create: [...] }` only fires on
+ * the `create` branch — this syncs RolePermission rows to exactly match
+ * the target list every time, safe to call repeatedly. See prisma/seed.ts
+ * for the original bug this fixed.
+ */
+export async function syncRolePermissions(
+  prisma: Pick<PrismaClient, "rolePermission">,
+  roleId: string,
+  permissions: Permission[],
+): Promise<void> {
+  await prisma.rolePermission.deleteMany({ where: { roleId, permission: { notIn: permissions } } });
+  await prisma.rolePermission.createMany({
+    data: permissions.map((permission) => ({ roleId, permission })),
+    skipDuplicates: true,
+  });
+}