RBAC System by cadencheng888 · Pull Request #10 · CSES-Dev/lims-lab-inventory

cadencheng888 · 2026-03-02T05:02:13Z

Describe your changes

Implements role-based access control system to assign users the right roles that contain the right permissions.

Issue ticket number and link

Checklist before requesting a review

My code follows the style guidelines of this project
I have performed a self-review of my code
I have commented my code, particularly in hard-to-understand areas
My changes generate no new warnings
I tested my code by adding unit tests
I tested my code by adding integration tests
This change requires a documentation update

arnavjk007

This is a good starting point, but we need to also implement the permissions and a getSession() function that can be called from all services which will return true or false if they are allowed to use that service. For example, a viewer should NOT be able to delete items or listings so if they call a DELETE api for those services, it should not work since our getSession() will say that they do not have perms. More detailsare in the notion task

arnavjk007

Look at comments

arnavjk007 · 2026-03-05T02:41:59Z

lib/rbac.ts

+    }
+
+    await connectToDatabase();
+    const user = await User.findOne({ email: session.user.email });


If we do use the User schema, how would we verify that the person is from UCSD? The Google sign in was one way, but we may have to modify the User DB as well to verify that the user is from UCSD.

also add .lean() at the end

arnavjk007 · 2026-03-05T02:47:07Z

models/User.ts

+        first: string;
+        last: string;
+    };
+    permissions: Role[];


we can have this as role: Role

arnavjk007 · 2026-03-05T02:47:33Z

models/User.ts

+// mongoose schema to valid the data
+const userSchema = new Schema<IUser>({
+
+    ucsdId: { type: String }, // ucsd pid


needs some restrictions like this:
ucsdId: { type: String, required: true, unique: true },

arnavjk007 · 2026-03-05T02:48:08Z

models/User.ts

+
+    labs: [
+        {
+            labId: { type: String, required: true },


We have a labs table so this should be, labId: { type: Schema.Types.ObjectId, ref: "Lab", required: true },

arnavjk007 · 2026-03-05T02:48:30Z

models/User.ts

+    notificationPreferences: { // default notification preferences
+        email: { type: Boolean, default: true },
+        inApp: { type: Boolean, default: true },
+        sms: { type: Boolean, default: true },


we can turn off sms by default

arnavjk007 · 2026-03-05T02:48:46Z

models/User.ts

+    safety: {
+        trainingCompleted: string[];
+        clearanceLevel: string;
+        lastReviwedAt: Date;


arnavjk007 · 2026-03-05T02:49:31Z

models/User.ts

+
+// describes what one lab membership looks like
+export interface ILabMembership {
+    labId: string;


we have a lab schema and table so it should reference that like: labId: { type: Schema.Types.ObjectId, ref: "Lab", required: true },

arnavjk007 · 2026-03-05T02:52:09Z

lib/rbac.ts

+    const session = await auth();
+
+    if (!session?.user?.email) {
+        return { allowed: false, user: null };


is it possible to add a "reason" field so when there is an error we know why it erroed? like here its unauthenticated

lib/rbac.ts

arnavjk007

Some changes to user schema to check for @UCSD in email. Also add unit tests for the user creation, deletion.. etc. Remember to do git pull from main and git merge main before doing unit tests.

Also major change, we need GET POST PUT and DELETE for users so we would have to create a service file and route file like:
app/api/user/route.ts & services/user/uses.ts

arnavjk007 · 2026-03-09T21:27:34Z

models/User.ts

+import mongoose, { Schema, Document, Types } from "mongoose";
+
+export type Role = "PI" | "LAB_MANAGER" | "RESEARCHER" | "VIEWER";
+


nit: we can have this setup for status as well like export type Status = "ACTIVE" | "INACTIVE" | "SUSPENDED";

arnavjk007 · 2026-03-09T21:27:56Z

models/User.ts

+        department: string;
+        phone: string;
+    }
+    status: "ACTIVE" | "INACTIVE" | "SUSPENDED";


status: Status

arnavjk007 · 2026-03-09T21:29:04Z

models/User.ts

+const userSchema = new Schema<IUser>({
+
+    ucsdId: { type: String, required: true, unique: true }, // ucsd pid
+    email: { type: String, required: true, unique: true }, // ucsd email


We should check here if the email is @UCSD domain by using regex and match like this:
email: {
type: String,
required: true,
unique: true,
lowercase: true,
trim: true,
match: [/^\S+@ucsd.edu$/, "Must be a valid UCSD email (@ucsd.edu)"],
},

arnavjk007 · 2026-03-09T21:31:10Z

models/User.ts

+{
+    timestamps: true,
+});
+


Let's also add a index so we can query by labId and get all users in that lab.
userSchema.index({ "labs.labId": 1 });

Add user model with RBAC fields

2724c72

cadencheng888 requested a review from arnavjk007 as a code owner March 2, 2026 05:02

Updated user model schema with comments

704cf85

arnavjk007 requested changes Mar 2, 2026

View reviewed changes

Add getSession() and ROLE_PERMISSIONS to rbac.ts

f5c885b

arnavjk007 requested changes Mar 5, 2026

View reviewed changes

Updated based on comments

5120b17

arnavjk007 requested changes Mar 9, 2026

View reviewed changes

		import mongoose, { Schema, Document, Types } from "mongoose";

		export type Role = "PI" \| "LAB_MANAGER" \| "RESEARCHER" \| "VIEWER";

Conversation

cadencheng888 commented Mar 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Describe your changes

Issue ticket number and link

Checklist before requesting a review

Uh oh!

arnavjk007 left a comment

Choose a reason for hiding this comment

Uh oh!

arnavjk007 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

arnavjk007 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

cadencheng888 commented Mar 2, 2026 •

edited

Loading