Permissions refactored #208

Rufat00 · 2025-10-30T05:10:47Z

Why

The previous role and permissions system was dangerous and unscalable

What

Adds separate roles table
New smart permissions system
New admin section to create and manage roles
Introduced getCurrentUser helper to make process of getting user info easier

Satisfies

https://linear.app/acmutsa/issue/HK-201/revamps-permission-system-for-hackkit
resolves #198

Copilot

Pull Request Overview

This PR implements a comprehensive role-based access control (RBAC) system with granular permissions, user banning functionality, and various improvements. The old hardcoded role enum is replaced with a dynamic database-backed roles system with a permissions bitmask architecture.

Replaces hardcoded roles with a database-backed roles system using permission bitmasks
Adds user banning/suspension functionality with ban tracking
Implements permission-based access control across admin features
Removes deprecated backup app dependencies from pnpm-lock.yaml

Reviewed Changes

Copilot reviewed 56 out of 58 changed files in this pull request and generated 14 comments.

Show a summary per file

File	Description
pnpm-lock.yaml	Removes unused backup app dependencies and deprecated package entries
packages/db/schema.ts	Adds roles and bannedUsers tables, converts role field to role_id foreign key
packages/db/types.ts	Adds UserWithRole type including role relation
packages/db/functions/*.ts	Updates queries to include role relations
apps/web/src/lib/constants/permission.ts	Defines PermissionType enum with bitwise flags
apps/web/src/lib/utils/shared/permission.ts	Implements PermissionMask class for permission management
apps/web/src/lib/utils/server/admin.ts	Refactors admin checks to use permission-based system
apps/web/src/components/admin/roles/*	Adds role management UI components
apps/web/src/components/admin/users/BanUserDialog.tsx	Adds user banning dialog
apps/web/src/components/Restricted.tsx	Permission-based component visibility wrapper
apps/web/src/middleware.ts	Adds ban check middleware
apps/web/src/actions/admin/*.ts	Updates actions with permission checks
apps/web/src/app/admin/*/.tsx	Updates admin pages with permission-based guards

Files not reviewed (1)

pnpm-lock.yaml: Language not supported

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-10-30T05:17:33Z

apps/web/src/components/admin/users/UpdateRoleDialog.tsx

+							<Badge>{currentRoleName}</Badge>
 							<span>&rarr;</span>
-							<Badge>
-								{titleCase(roleToSet.replace("_", " "))}
-							</Badge>
+							<Badge>{currentRoleName}</Badge>


The target role badge displays currentRoleName instead of the new role name. Line 94 should display the name of the role being changed to (roleToSet), not the current role.

Copilot · 2025-10-30T05:17:34Z

apps/web/src/components/admin/users/BanUserDialog.tsx

+				<DialogHeader>
+					<DialogTitle>Ban {name}.</DialogTitle>
+					<DialogDescription>
+						Ban this user (not permament action).


Corrected spelling of 'permament' to 'permanent'.

Suggested change

Ban this user (not permament action).

Ban this user (not permanent action).

Copilot · 2025-10-30T05:17:34Z

apps/web/src/components/admin/users/RemoveUserBanDialog.tsx

+	const { execute } = useAction(removeUserBan, {
+		async onSuccess() {
+			toast.dismiss();
+			toast.success("Suspension successfuly removed!");


Corrected spelling of 'successfuly' to 'successfully'.

Copilot · 2025-10-30T05:17:34Z

apps/web/src/components/admin/users/RemoveUserBanDialog.tsx

+		},
+		async onError(e) {
+			toast.dismiss();
+			toast.error("An error occurred while removing suspenssion.");


Corrected spelling of 'suspenssion' to 'suspension'.

Copilot · 2025-10-30T05:17:35Z

apps/web/src/app/admin/users/[slug]/page.tsx

+			{!!banInstance && (
+				<div className="absolute left-0 top-28 w-screen bg-destructive p-2 text-center">
+					<strong>
+						This user has been suspended, reason for suspenssion:{" "}


Corrected spelling of 'suspenssion' to 'suspension'.

Suggested change

This user has been suspended, reason for suspenssion:{" "}

This user has been suspended, reason for suspension:{" "}

Copilot · 2025-10-30T05:17:36Z

apps/web/src/components/admin/roles/RoleCard.tsx

+	const canDeleteRole = (() => {
+		try {
+			return (
+				userHasPermission(currentUser, PermissionType.DELETE_ROLES) &&
+				compareUserPosition(currentUser, role.position, "higher")
+			);
+		} catch (e) {
+			return false;
+		}
+	})();


Unused variable canDeleteRole.

Suggested change

const canDeleteRole = (() => {

try {

return (

userHasPermission(currentUser, PermissionType.DELETE_ROLES) &&

compareUserPosition(currentUser, role.position, "higher")

);

} catch (e) {

return false;

}

})();

Copilot · 2025-10-30T05:17:37Z

apps/web/src/components/emails/RegistrationSuccessEmail.tsx

+import {
+	Body,
+	Button,
+	Container,
+	Column,
+	Head,
+	Heading,
+	Hr,
+	Html,
+	Img,
+	Link,
+	Preview,
+	Row,
+	Section,
+	Tailwind,
+	Text,
+} from "@react-email/components";


Unused imports Button, Column, Head, Hr, Html, Link, Preview, Row.

Copilot · 2025-10-30T05:17:37Z

packages/db/functions/user.ts

@@ -1,18 +1,24 @@
-import { db, eq } from "..";
-import { userCommonData, userHackerData } from "../schema";
+import { SQLiteRelationalQuery } from "drizzle-orm/sqlite-core/query-builders/query";


Unused import SQLiteRelationalQuery.

Copilot · 2025-10-30T05:17:37Z

packages/db/functions/user.ts

-import { db, eq } from "..";
-import { userCommonData, userHackerData } from "../schema";
+import { SQLiteRelationalQuery } from "drizzle-orm/sqlite-core/query-builders/query";
+import { db, eq, InferSelectModel } from "..";


Unused import InferSelectModel.

Copilot · 2025-10-30T05:17:38Z

packages/db/functions/user.ts

-import { userCommonData, userHackerData } from "../schema";
+import { SQLiteRelationalQuery } from "drizzle-orm/sqlite-core/query-builders/query";
+import { db, eq, InferSelectModel } from "..";
+import { roles, userCommonData, userHackerData } from "../schema";


Unused import roles.

cloudflare-workers-and-pages · 2025-11-01T00:43:11Z

Deploying hackkit with Cloudflare Pages

Latest commit:	`f5f2a1b`
Status:	✅ Deploy successful!
Preview URL:	https://8c961bbf.hackkit.pages.dev
Branch Preview URL:	https://permissions-refactored.hackkit.pages.dev

View logs

joshuasilva414 · 2025-11-02T21:53:09Z

New user registration does not seem to be working

joshuasilva414

I have some concerns about this use case I found where a role can move themselves up above other roles and then change the lower roles permissions if they have the right boxes checked.

I'm also curious about this disable checkbox. Why can't I turn off this permission, but I can turn off all the other ones?

Rufat00 added 3 commits September 28, 2025 18:43

Fixed navbar color

929f81a

Added ability to ban users

b14325f

Permissions and Roles Refactored

f4eb3be

Rufat00 requested review from Copilot and joshuasilva414 October 30, 2025 05:13

Copilot AI reviewed Oct 30, 2025

View reviewed changes

removed unused imports, incorrect spellings fixed

d936234

Some Errors fixed, and final touch

b0bdd64

joshuasilva414 requested changes Nov 4, 2025

View reviewed changes

Fixed: Role position guard wasn't working

8b0c39d

Rufat00 requested a review from joshuasilva414 November 5, 2025 04:22

Rufat00 and others added 3 commits November 4, 2025 22:26

Merge branch 'dev' into permissions_refactored

ae15f06

pnpm lock up to date

690f721

Synchronised dev with current update

f5f2a1b

Rufat00 assigned Rufat00 and unassigned Rufat00 Nov 6, 2025

	Ban this user (not permament action).
	Ban this user (not permanent action).

	This user has been suspended, reason for suspenssion:{" "}
	This user has been suspended, reason for suspension:{" "}

Permissions refactored #208

Are you sure you want to change the base?

Permissions refactored #208

Uh oh!

Conversation

Rufat00 commented Oct 30, 2025

Why

What

Satisfies

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Oct 30, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 30, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 30, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 30, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 30, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 30, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 30, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 30, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 30, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 30, 2025

Choose a reason for hiding this comment

Uh oh!

cloudflare-workers-and-pages bot commented Nov 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying hackkit with Cloudflare Pages

Uh oh!

joshuasilva414 commented Nov 2, 2025

Uh oh!

joshuasilva414 left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

cloudflare-workers-and-pages bot commented Nov 1, 2025 •

edited

Loading