feat(auth): centralize ThothII permission enforcement

backend/src/auth/authorization.ts

@@ -0,0 +1,24 @@
+import type { FastifyReply, FastifyRequest } from "fastify";
+import type { Permission } from "./types.js";
+import { getPrincipal } from "./auth.js";
+import type { PrincipalContext } from "./principal.js";
+
+export function hasPermission(principal: PrincipalContext, permission: Permission): boolean {
+  return principal.permissions.includes(permission);
+}
+
+export function isPrincipalContext(
+  value: PrincipalContext | FastifyReply,
+): value is PrincipalContext {
+  return "issuer" in value;
+}
+
+export function requirePermission(
+  request: FastifyRequest,
+  reply: FastifyReply,
+  permission: Permission,
+): PrincipalContext | FastifyReply {
+  const principal = getPrincipal(request);
+  if (hasPermission(principal, permission)) return principal;
+  return reply.code(403).send({ code: "auth_forbidden", error: "This operation is not permitted" });
+}