Add audit administrator role helpers

apps/aether-gateway/src/lib.rs

@@ -55,6 +55,7 @@ mod privacy;
 mod provider_key_auth;
 pub(crate) use aether_provider_transport as provider_transport;
 mod rate_limit;
+mod roles;
 mod request_candidate_runtime;
 mod router;
 mod scheduler;

apps/aether-gateway/src/roles.rs

@@ -0,0 +1,49 @@
+pub(crate) const ROLE_USER: &str = "user";
+pub(crate) const ROLE_ADMIN: &str = "admin";
+pub(crate) const ROLE_AUDIT_ADMIN: &str = "audit_admin";
+
+pub(crate) fn is_full_admin_role(role: &str) -> bool {
+    role.trim().eq_ignore_ascii_case(ROLE_ADMIN)
+}
+
+pub(crate) fn is_audit_admin_role(role: &str) -> bool {
+    role.trim().eq_ignore_ascii_case(ROLE_AUDIT_ADMIN)
+}
+
+pub(crate) fn can_access_admin_console(role: &str) -> bool {
+    is_full_admin_role(role) || is_audit_admin_role(role)
+}
+
+pub(crate) fn can_write_admin_console(role: &str) -> bool {
+    is_full_admin_role(role)
+}
+
+pub(crate) fn normalize_assignable_user_role(role: &str) -> Option<&'static str> {
+    match role.trim().to_ascii_lowercase().as_str() {
+        ROLE_USER => Some(ROLE_USER),
+        ROLE_ADMIN => Some(ROLE_ADMIN),
+        ROLE_AUDIT_ADMIN => Some(ROLE_AUDIT_ADMIN),
+        _ => None,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{
+        can_access_admin_console, can_write_admin_console, normalize_assignable_user_role,
+    };
+
+    #[test]
+    fn audit_admin_can_access_but_not_write_admin_console() {
+        assert!(can_access_admin_console("audit_admin"));
+        assert!(!can_write_admin_console("audit_admin"));
+    }
+
+    #[test]
+    fn assignable_roles_include_audit_admin() {
+        assert_eq!(normalize_assignable_user_role(" audit_admin "), Some("audit_admin"));
+        assert_eq!(normalize_assignable_user_role("admin"), Some("admin"));
+        assert_eq!(normalize_assignable_user_role("user"), Some("user"));
+        assert_eq!(normalize_assignable_user_role("owner"), None);
+    }
+}