bramw_baserow/web-frontend/modules/builder/utils/visibility.js

import {
  VISIBILITY_ALL,
  ROLE_TYPE_ALLOW_EXCEPT,
  ROLE_TYPE_DISALLOW_EXCEPT,
  ROLE_TYPE_ALLOW_ALL,
} from '@baserow/modules/builder/constants'

/**
 * Evaluates the Page's visibility settings and the user's role. Returns true
 * if the user is allowed to view the page. Otherwise, returns false.
 *
 * @param {Object} user The user object.
 * @param {Boolean} isAuthenticated Whether the user is authenticated.
 * @param {Object} page The Page to be evaluated.
 * @returns {Boolean} True if the user is allowed to view the page, false otherwise.
 */
export function userCanViewPage(user, isAuthenticated, page) {
  if (page.visibility === VISIBILITY_ALL) {
    return true
  }

  // If visibility is 'logged-in' (i.e. not 'all') *and* the user isn't
  // authenticated, disallow access.
  if (!isAuthenticated) {
    return false
  }

  if (page.role_type === ROLE_TYPE_ALLOW_EXCEPT) {
    // Allow if the user's role isn't explicitly excluded
    return !page.roles.includes(user.role)
  } else if (page.role_type === ROLE_TYPE_DISALLOW_EXCEPT) {
    // Allow if the user's role is explicitly included
    return page.roles.includes(user.role)
  } else if (page.role_type === ROLE_TYPE_ALLOW_ALL) {
    // Allow if there are no page level role restrictions
    return true
  }

  // Disallow access to the page by default
  return false
}