feat: more role backend and admin/writer roles additions and adjustments

internal/domain/role/roleDomain.go

@@ -11,6 +11,8 @@ var (
 	ErrRoleConflict      = errors.New("role was modified concurrently")
 	ErrInvalidScope      = errors.New("invalid scope for permission")
 	ErrOwnerOnlyGrant    = errors.New("owner-only permission granted to a non-owner role")
+
+	ErrMissingPermission = errors.New("missing permission")
 )
 
 type Scope string

internal/domain/role/roleGrantSet.go

@@ -0,0 +1,40 @@
+package role
+
+type MissingPermissionError struct {
+	Key string
+}
+
+func (e MissingPermissionError) Error() string {
+	return ErrMissingPermission.Error() + ": " + e.Key
+}
+
+func (e MissingPermissionError) Is(target error) bool {
+	return target == ErrMissingPermission
+}
+
+type GrantSet map[string]Scope
+
+func NewGrantSet(grants []Grant) GrantSet {
+	set := make(GrantSet, len(grants))
+	for _, grant := range grants {
+		set[grant.Key] = grant.Scope
+	}
+	return set
+}
+
+func (g GrantSet) Scope(key string) Scope {
+	scope, present := g[key]
+	if !present {
+		return ScopeNone
+	}
+	return scope
+}
+
+func (g GrantSet) Holds(key string) bool {
+	scope := g.Scope(key)
+	return scope == ScopeOwn || scope == ScopeAll
+}
+
+func (g GrantSet) HoldsAll(key string) bool {
+	return g.Scope(key) == ScopeAll
+}

internal/domain/role/roleKeys.go

@@ -0,0 +1,11 @@
+package role
+
+const (
+	KeyActivityView   = "activity.view"
+	KeyActivityExport = "activity.export"
+	KeyAPIKeysView    = "apikeys.view"
+	KeyAPIKeysRevoke  = "apikeys.revoke"
+	KeyAuthorsEdit    = "authors.edit"
+	KeyUsersView      = "users.view"
+	KeyApplyUpdates   = "system.apply_updates"
+)