✨ feat (rbac): implement role-based access control

app/middleware/auth.global.ts

@@ -1,4 +1,6 @@
 export default defineNuxtRouteMiddleware((to) => {
+  if (to.meta.public) return
+
   const { $pinia } = useNuxtApp()
 
   if (import.meta.client) {
@@ -10,9 +12,13 @@ export default defineNuxtRouteMiddleware((to) => {
       return navigateTo('/auth/login')
     }
 
-    const allowedRoles = to.meta.roles as string[] | undefined
-    if (allowedRoles && !allowedRoles.includes(userStore.userRole)) {
-      return navigateTo('/unauthorized')
-    }
+    // const allowedRoles = to.meta.roles as string[] | undefined
+    // if (allowedRoles && !allowedRoles.includes(userStore.userRole)) {
+    //   return navigateTo('/unauthorized')
+    // }
+    // const allowedRoles = to.meta.roles as string[] | undefined
+    // if (allowedRoles && !userStore.userRole.some((r) => allowedRoles.includes(r))) {
+    //   return navigateTo('/unauthorized')
+    // }
   }
 })

app/middleware/rbac.ts

@@ -0,0 +1,37 @@
+import { PAGE_PERMISSIONS } from '~/lib/page-permission'
+
+export default defineNuxtRouteMiddleware((to) => {
+  if (to.meta.public) return
+
+  const { $pinia } = useNuxtApp()
+  if (import.meta.server) {
+    const authStore = useUserStore($pinia)
+    // Check specific page permissions if defined in config
+    const pagePermissions = PAGE_PERMISSIONS[to.path as keyof typeof PAGE_PERMISSIONS]
+    if (pagePermissions) {
+      const { checkRole } = useRBAC()
+      if (!checkRole(pagePermissions)) {
+        throw createError({
+          statusCode: 403,
+          statusMessage: 'Forbidden - Insufficient permissions for this page',
+        })
+      }
+    }
+
+    // Fallback to meta roles
+    const requiredRoles = to.meta.roles as string[]
+    if (requiredRoles && requiredRoles.length > 0) {
+      // FIXME: change this dummy roles, when api is ready
+      // const userRoles = authStore.roles
+      const userRoles = ['admisi']
+      const hasRequiredRole = requiredRoles.some((role) => userRoles.includes(role))
+
+      if (!hasRequiredRole) {
+        throw createError({
+          statusCode: 403,
+          statusMessage: 'Forbidden - Insufficient role permissions',
+        })
+      }
+    }
+  }
+})