feat: support parent-based areaRestrictions in config for areas.json

config/local.example.json

@@ -90,11 +90,13 @@
     "areaRestrictions": [
       {
         "roles": [],
-        "areas": []
+        "areas": [],
+        "parent": []
       },
       {
         "roles": [],
-        "areas": []
+        "areas": [],
+        "parent": []
       }
     ],
     "aliases": [

packages/config/lib/mutations.js

@@ -307,9 +307,10 @@ const applyMutations = (config) => {
   })
 
   config.authentication.areaRestrictions =
-    config.authentication.areaRestrictions.map(({ roles, areas }) => ({
+    config.authentication.areaRestrictions.map(({ roles, areas, parent }) => ({
       roles: roles.flatMap(replaceAliases),
       areas,
+      parent,
     }))
 
   config.authentication.strategies = config.authentication.strategies.map(

packages/types/lib/config.d.ts

@@ -53,7 +53,7 @@ export type Config<Client extends boolean = false> = DeepMerge<
     }
     areas: ConfigAreas
     authentication: {
-      areaRestrictions: { roles: string[]; areas: string[] }[]
+      areaRestrictions: { roles: string[]; areas: string[]; parent?: string[] }[]
       // Unfortunately these types are not convenient for looping the `perms` object...
       // excludeFromTutorial: (keyof BaseConfig['authentication']['perms'])[]
       // alwaysEnabledPerms: (keyof BaseConfig['authentication']['perms'])[]

server/src/graphql/resolvers.js

@@ -362,6 +362,7 @@ const resolvers = {
               (feature) =>
                 !feature.properties.hidden &&
                 (!perms.areaRestrictions.length ||
+                  perms.areaRestrictions.includes(feature.properties.key) ||
                   perms.areaRestrictions.includes(feature.properties.name) ||
                   perms.areaRestrictions.includes(feature.properties.parent)),
             ),
@@ -380,7 +381,9 @@ const resolvers = {
               children: perms.areaRestrictions.includes(parent.name)
                 ? parent.children
                 : parent.children.filter((child) =>
-                    perms.areaRestrictions.includes(child.properties.name),
+                    perms.areaRestrictions.includes(child.properties.key) ||
+                    perms.areaRestrictions.includes(child.properties.name) ||
+                    perms.areaRestrictions.includes(child.properties.parent),
                   ),
             }))
             .filter((parent) => parent.children.length)

server/src/utils/areaPerms.js

@@ -9,20 +9,50 @@ function areaPerms(roles) {
   const areaRestrictions = config.getSafe('authentication.areaRestrictions')
   const areas = config.getSafe('areas')
 
+  // Map parent names to child keys for easy lookup when parent-based restrictions are used.
+  const parentKeyMap = Object.values(areas.scanAreasObj).reduce(
+    (acc, feature) => {
+      const parent = feature.properties.parent
+      if (!parent) return acc
+      if (!acc[parent]) acc[parent] = []
+      acc[parent].push(feature.properties.key)
+      return acc
+    },
+    /** @type {Record<string, string[]>} */ ({}),
+  )
+
   const perms = []
   for (let i = 0; i < roles.length; i += 1) {
     for (let j = 0; j < areaRestrictions.length; j += 1) {
-      if (areaRestrictions[j].roles.includes(roles[i])) {
-        if (areaRestrictions[j].areas.length) {
-          for (let k = 0; k < areaRestrictions[j].areas.length; k += 1) {
-            if (areas.names.has(areaRestrictions[j].areas[k])) {
-              perms.push(areaRestrictions[j].areas[k])
-            } else if (areas.withoutParents[areaRestrictions[j].areas[k]]) {
-              perms.push(...areas.withoutParents[areaRestrictions[j].areas[k]])
-            }
+      if (!areaRestrictions[j].roles.includes(roles[i])) continue
+
+      const hasAreas = Array.isArray(areaRestrictions[j].areas)
+        ? areaRestrictions[j].areas.length > 0
+        : false
+      const hasParents = Array.isArray(areaRestrictions[j].parent)
+        ? areaRestrictions[j].parent.length > 0
+        : false
+
+      // No areas/parents means unrestricted access
+      if (!hasAreas && !hasParents) return []
+
+      if (hasAreas) {
+        for (let k = 0; k < areaRestrictions[j].areas.length; k += 1) {
+          const target = areaRestrictions[j].areas[k]
+          if (areas.names.has(target)) {
+            perms.push(target)
+          } else if (areas.withoutParents[target]) {
+            perms.push(...areas.withoutParents[target])
           }
-        } else {
-          return []
+        }
+      }
+
+      if (hasParents) {
+        for (let k = 0; k < areaRestrictions[j].parent.length; k += 1) {
+          const parent = areaRestrictions[j].parent[k]
+          // If the parent itself exists as a top-level area, allow it too.
+          if (areas.names.has(parent)) perms.push(parent)
+          if (parentKeyMap[parent]) perms.push(...parentKeyMap[parent])
         }
       }
     }