Update

apps/admin/src/providers/authProvider.ts

@@ -1,6 +1,37 @@
 import { AuthProvider } from 'react-admin';
 import { supabase } from '../config';
 
+// Define admin roles
+export type AdminRole = 'pack_creator' | 'super_admin';
+
+// Permission structure
+export interface AdminPermissions {
+    role: AdminRole;
+    permissions: Array<{ action: string; resource: string }>;
+}
+
+// Define permissions by role
+const ROLE_PERMISSIONS: Record<AdminRole, Array<{ action: string; resource: string }>> = {
+    pack_creator: [
+        { action: 'list', resource: 'question_packs' },
+        { action: 'create', resource: 'question_packs' },
+        { action: 'edit', resource: 'question_packs' },
+        { action: 'delete', resource: 'question_packs' },
+        { action: 'show', resource: 'question_packs' },
+        { action: 'list', resource: 'questions' },
+        { action: 'create', resource: 'questions' },
+        { action: 'edit', resource: 'questions' },
+        { action: 'delete', resource: 'questions' },
+        { action: 'show', resource: 'questions' },
+    ],
+    super_admin: [
+        // Full access to all resources
+        { action: '*', resource: '*' },
+    ],
+};
+
+const PERMISSIONS_KEY = 'admin_permissions';
+
 export const authProvider: AuthProvider = {
     login: async ({ username, password }) => {
         const { data, error } = await supabase.auth.signInWithPassword({
@@ -10,21 +41,96 @@ export const authProvider: AuthProvider = {
         if (error) {
             throw new Error(error.message);
         }
+
+        // Fetch admin role
+        const { data: adminData, error: adminError } = await supabase
+            .from('admin_users')
+            .select('role')
+            .eq('user_id', data.user.id)
+            .single();
+
+        if (adminError || !adminData) {
+            await supabase.auth.signOut();
+            throw new Error('Access denied. You are not an administrator.');
+        }
+
+        // Store permissions
+        const permissions: AdminPermissions = {
+            role: adminData.role as AdminRole,
+            permissions: ROLE_PERMISSIONS[adminData.role as AdminRole],
+        };
+        localStorage.setItem(PERMISSIONS_KEY, JSON.stringify(permissions));
+
         return Promise.resolve();
     },
+
     logout: async () => {
+        localStorage.removeItem(PERMISSIONS_KEY);
         await supabase.auth.signOut();
         return Promise.resolve();
     },
+
     checkError: async (error) => {
         if (error.status === 401 || error.status === 403) {
+            localStorage.removeItem(PERMISSIONS_KEY);
             return Promise.reject();
         }
         return Promise.resolve();
     },
+
     checkAuth: async () => {
         const session = await supabase.auth.getSession();
-        return session.data.session ? Promise.resolve() : Promise.reject();
+        const permissions = localStorage.getItem(PERMISSIONS_KEY);
+
+        if (!session.data.session || !permissions) {
+            return Promise.reject();
+        }
+        return Promise.resolve();
+    },
+
+    getPermissions: async () => {
+        const permissions = localStorage.getItem(PERMISSIONS_KEY);
+        if (!permissions) {
+            return Promise.reject();
+        }
+        return JSON.parse(permissions) as AdminPermissions;
+    },
+
+    canAccess: async ({ resource, action }) => {
+        const permissionsStr = localStorage.getItem(PERMISSIONS_KEY);
+        if (!permissionsStr) {
+            return false;
+        }
+
+        const { permissions } = JSON.parse(permissionsStr) as AdminPermissions;
+
+        // Check for wildcard (super_admin)
+        if (permissions.some(p => p.action === '*' && p.resource === '*')) {
+            return true;
+        }
+
+        // Check specific permission
+        return permissions.some(
+            p => p.resource === resource && (p.action === action || p.action === '*')
+        );
+    },
+
+    getIdentity: async () => {
+        const { data } = await supabase.auth.getUser();
+        if (!data.user) {
+            throw new Error('No user');
+        }
+
+        const permissionsStr = localStorage.getItem(PERMISSIONS_KEY);
+        const role = permissionsStr
+            ? (JSON.parse(permissionsStr) as AdminPermissions).role
+            : 'unknown';
+
+        return {
+            id: data.user.id,
+            fullName: data.user.email,
+            avatar: undefined,
+            role,
+        };
     },
-    getPermissions: () => Promise.resolve(),
 };