init commit for iPAL-kit plugin

src/modules/access/access.ts

@@ -0,0 +1,42 @@
+import type { Access, FieldAccess } from 'payload'
+
+import type { Role } from './types.js'
+
+import { hasMinimumRole, isAdmin } from './predicates.js'
+
+/**
+ * Collection-level access (returns boolean | Where).
+ * Use in collection `access.read/create/update/delete`.
+ */
+export const adminOnly: Access = ({ req: { user } }) => isAdmin(user)
+
+export const adminOrEditor: Access = ({ req: { user } }) => hasMinimumRole(user, 'editor')
+
+export const authenticated: Access = ({ req: { user } }) => Boolean(user)
+
+/** Requires at least the given role. */
+export const requireRole =
+  (minimum: Role): Access =>
+  ({ req: { user } }) =>
+    hasMinimumRole(user, minimum)
+
+/** Admins see all; others are constrained to their own document. */
+export const adminOrSelf: Access = ({ req: { user } }) => {
+  if (isAdmin(user)) {return true}
+  if (!user) {return false}
+  return { id: { equals: user.id } }
+}
+
+/**
+ * Field-level access (returns boolean only — no Where support).
+ * Use in field `access.read/update`.
+ */
+export const adminOnlyField: FieldAccess = ({ req: { user } }) => isAdmin(user)
+
+export const adminOrEditorField: FieldAccess = ({ req: { user } }) => hasMinimumRole(user, 'editor')
+
+/** Requires at least the given role, for field-level access. */
+export const requireRoleField =
+  (minimum: Role): FieldAccess =>
+  ({ req: { user } }) =>
+    hasMinimumRole(user, minimum)