Feat v0.9.9 surface access roles (#83)

Co-authored-by: Jeffrey Smith <jasafpro@gmail.com>
Co-committed-by: Jeffrey Smith <jasafpro@gmail.com>

server/pages/pages.go

@@ -522,7 +522,7 @@ func (e *Engine) RenderExtensionSurface() gin.HandlerFunc {
 		}
 
 		// ── Access check ─────────────────────────────────────────
-		if !evaluateAccess(c, surfaceAccess) {
+		if !e.evaluateAccess(c, surfaceAccess) {
 			// Redirect unauthenticated users to login; deny others with 403
 			if c.GetString("user_id") == "" {
 				c.Redirect(http.StatusTemporaryRedirect, e.cfg.BasePath+"/login")
@@ -651,7 +651,7 @@ func aggregateAccess(surfaces []any) string {
 }
 
 // evaluateAccess checks whether the current request meets an access requirement.
-func evaluateAccess(c *gin.Context, access string) bool {
+func (e *Engine) evaluateAccess(c *gin.Context, access string) bool {
 	switch {
 	case access == "public":
 		return true
@@ -672,6 +672,20 @@ func evaluateAccess(c *gin.Context, access string) bool {
 			}
 		}
 		return false
+	case strings.HasPrefix(access, "role:"):
+		role := strings.TrimPrefix(access, "role:")
+		userID := c.GetString("user_id")
+		if userID == "" {
+			return false
+		}
+		if c.GetBool("is_admin") {
+			return true
+		}
+		if e.stores.Teams == nil {
+			return false
+		}
+		has, err := e.stores.Teams.HasRoleInAnyTeam(c.Request.Context(), userID, role)
+		return err == nil && has
 	default:
 		return false
 	}

server/pages/pages_handler_test.go

@@ -11,9 +11,69 @@ import (
 	"github.com/gin-gonic/gin"
 
 	"armature/config"
+	"armature/models"
 	"armature/store"
 )
 
+// ── mock TeamStore ───────────────────────────────────────────
+
+// mockTeamStore implements store.TeamStore with a simple role lookup map.
+// Only HasRoleInAnyTeam is functional; everything else is a no-op stub.
+type mockTeamStore struct {
+	// userRoles maps userID → set of roles they hold in any team
+	userRoles map[string]map[string]bool
+}
+
+func newMockTeamStore() *mockTeamStore {
+	return &mockTeamStore{userRoles: make(map[string]map[string]bool)}
+}
+
+func (m *mockTeamStore) addRole(userID, role string) {
+	if m.userRoles[userID] == nil {
+		m.userRoles[userID] = make(map[string]bool)
+	}
+	m.userRoles[userID][role] = true
+}
+
+func (m *mockTeamStore) HasRoleInAnyTeam(_ context.Context, userID, role string) (bool, error) {
+	if roles, ok := m.userRoles[userID]; ok {
+		return roles[role], nil
+	}
+	return false, nil
+}
+
+// Stubs — not exercised by surface access tests.
+func (m *mockTeamStore) Create(context.Context, *models.Team) error                       { return nil }
+func (m *mockTeamStore) GetByID(context.Context, string) (*models.Team, error)            { return nil, nil }
+func (m *mockTeamStore) Update(context.Context, string, map[string]interface{}) error     { return nil }
+func (m *mockTeamStore) Delete(context.Context, string) error                             { return nil }
+func (m *mockTeamStore) List(context.Context) ([]models.Team, error)                      { return nil, nil }
+func (m *mockTeamStore) ListForUser(context.Context, string) ([]models.Team, error)       { return nil, nil }
+func (m *mockTeamStore) AddMember(context.Context, string, string, string) error          { return nil }
+func (m *mockTeamStore) RemoveMember(context.Context, string, string) error               { return nil }
+func (m *mockTeamStore) UpdateMemberRole(context.Context, string, string, string) error   { return nil }
+func (m *mockTeamStore) ListMembers(context.Context, string) ([]models.TeamMember, error) { return nil, nil }
+func (m *mockTeamStore) GetMember(context.Context, string, string) (*models.TeamMember, error) { return nil, nil }
+func (m *mockTeamStore) GetUserTeamIDs(context.Context, string) ([]string, error)         { return nil, nil }
+func (m *mockTeamStore) IsTeamAdmin(context.Context, string, string) (bool, error)        { return false, nil }
+func (m *mockTeamStore) IsMember(context.Context, string, string) (bool, error)           { return false, nil }
+func (m *mockTeamStore) Exists(context.Context, string) (bool, error)                     { return false, nil }
+func (m *mockTeamStore) UpdateMemberRoleByID(context.Context, string, string, string) (int64, error) { return 0, nil }
+func (m *mockTeamStore) DeleteMemberByID(context.Context, string, string) (int64, error)  { return 0, nil }
+func (m *mockTeamStore) ListTeamAuditActions(context.Context, string) ([]string, error)   { return nil, nil }
+func (m *mockTeamStore) GetFirstTeamIDForUser(context.Context, string) (string, error)    { return "", nil }
+func (m *mockTeamStore) AddMemberReturningID(context.Context, string, string, string) (string, error) { return "", nil }
+func (m *mockTeamStore) MergeSettings(context.Context, string, string) error              { return nil }
+func (m *mockTeamStore) AddUserRole(context.Context, string, string, string, string) error { return nil }
+func (m *mockTeamStore) RemoveUserRole(context.Context, string, string, string) error     { return nil }
+func (m *mockTeamStore) ListUserRoles(context.Context, string, string) ([]string, error)  { return nil, nil }
+func (m *mockTeamStore) GetMemberRoles(context.Context, string, string) ([]string, error) { return nil, nil }
+func (m *mockTeamStore) HasRole(context.Context, string, string, string) (bool, error)    { return false, nil }
+func (m *mockTeamStore) RemoveAllUserRoles(context.Context, string, string) error         { return nil }
+func (m *mockTeamStore) AddRoleToCatalog(context.Context, string, string, string) error   { return nil }
+func (m *mockTeamStore) ListRoleCatalog(context.Context, string) ([]store.TeamRoleCatalogEntry, error) { return nil, nil }
+func (m *mockTeamStore) RemoveRoleCatalogBySource(context.Context, string, string) error  { return nil }
+
 // ── mock PackageStore ────────────────────────────────────────
 
 // mockPackageStore implements store.PackageStore with in-memory data.
@@ -293,3 +353,136 @@ func TestHandler_EarlyAuthShortCircuit(t *testing.T) {
 		t.Errorf("expected redirect to /login, got %s", loc)
 	}
 }
+
+// ── v0.9.9 — role-based surface access ──────────────────────
+
+// testRouterWithTeams builds a router whose Engine has a mock TeamStore.
+// The optAuth middleware also checks X-Admin header to set is_admin.
+func testRouterWithTeams(t *testing.T, teams *mockTeamStore, pkgs ...*store.PackageRegistration) *gin.Engine {
+	t.Helper()
+	gin.SetMode(gin.TestMode)
+	engine := &Engine{
+		cfg:     &config.Config{BasePath: ""},
+		stores:  store.Stores{Packages: newMockPackageStore(pkgs...), Teams: teams},
+		loaders: make(map[string]DataLoaderFunc),
+	}
+	engine.parseTemplates()
+	engine.registerCoreSurfaces()
+
+	r := gin.New()
+	optAuth := func(c *gin.Context) {
+		if uid := c.GetHeader("X-User-ID"); uid != "" {
+			c.Set("user_id", uid)
+			c.Set("role", "user")
+		}
+		if c.GetHeader("X-Admin") == "true" {
+			c.Set("is_admin", true)
+		}
+		c.Next()
+	}
+	apiAuth := func(c *gin.Context) { c.Next() }
+	apiHandler := func(c *gin.Context) { c.JSON(200, gin.H{"ok": true}) }
+	engine.RegisterExtensionRoutes(r.Group(""), optAuth, apiAuth, apiHandler)
+	return r
+}
+
+func TestHandler_RoleAccess_Granted(t *testing.T) {
+	teams := newMockTeamStore()
+	teams.addRole("user-1", "approver")
+
+	pkg := &store.PackageRegistration{
+		ID: "role-pkg", Title: "Role Pkg", Type: "surface", Source: "extension",
+		Enabled: true, Status: "active",
+		Manifest: map[string]any{
+			"surfaces": []any{
+				map[string]any{"path": "/", "access": "role:approver", "title": "Approvals"},
+			},
+		},
+	}
+	r := testRouterWithTeams(t, teams, pkg)
+	w := doGet(r, "/s/role-pkg", "X-User-ID", "user-1")
+	if w.Code != http.StatusOK {
+		t.Errorf("expected 200 for user with role, got %d", w.Code)
+	}
+}
+
+func TestHandler_RoleAccess_Denied(t *testing.T) {
+	teams := newMockTeamStore()
+	// user-2 has no roles
+
+	pkg := &store.PackageRegistration{
+		ID: "role-pkg", Title: "Role Pkg", Type: "surface", Source: "extension",
+		Enabled: true, Status: "active",
+		Manifest: map[string]any{
+			"surfaces": []any{
+				map[string]any{"path": "/", "access": "role:approver", "title": "Approvals"},
+			},
+		},
+	}
+	r := testRouterWithTeams(t, teams, pkg)
+	w := doGet(r, "/s/role-pkg", "X-User-ID", "user-2")
+	if w.Code != http.StatusForbidden {
+		t.Errorf("expected 403 for user without role, got %d", w.Code)
+	}
+}
+
+func TestHandler_RoleAccess_Unauthenticated(t *testing.T) {
+	teams := newMockTeamStore()
+
+	pkg := &store.PackageRegistration{
+		ID: "role-pkg", Title: "Role Pkg", Type: "surface", Source: "extension",
+		Enabled: true, Status: "active",
+		Manifest: map[string]any{
+			"surfaces": []any{
+				map[string]any{"path": "/", "access": "role:approver", "title": "Approvals"},
+			},
+		},
+	}
+	r := testRouterWithTeams(t, teams, pkg)
+	w := doGet(r, "/s/role-pkg") // no auth
+	if w.Code != http.StatusTemporaryRedirect {
+		t.Errorf("expected 307 redirect, got %d", w.Code)
+	}
+	loc := w.Header().Get("Location")
+	if !strings.Contains(loc, "/login") {
+		t.Errorf("expected redirect to /login, got %s", loc)
+	}
+}
+
+func TestHandler_RoleAccess_AdminBypass(t *testing.T) {
+	teams := newMockTeamStore()
+	// admin-user has no "approver" role but is_admin=true
+
+	pkg := &store.PackageRegistration{
+		ID: "role-pkg", Title: "Role Pkg", Type: "surface", Source: "extension",
+		Enabled: true, Status: "active",
+		Manifest: map[string]any{
+			"surfaces": []any{
+				map[string]any{"path": "/", "access": "role:approver", "title": "Approvals"},
+			},
+		},
+	}
+	r := testRouterWithTeams(t, teams, pkg)
+	w := doGet(r, "/s/role-pkg", "X-User-ID", "admin-user", "X-Admin", "true")
+	if w.Code != http.StatusOK {
+		t.Errorf("expected 200 for admin bypass, got %d", w.Code)
+	}
+}
+
+func TestHandler_RoleAccess_NilTeamStore(t *testing.T) {
+	// Engine with no team store — role access should deny gracefully
+	pkg := &store.PackageRegistration{
+		ID: "role-pkg", Title: "Role Pkg", Type: "surface", Source: "extension",
+		Enabled: true, Status: "active",
+		Manifest: map[string]any{
+			"surfaces": []any{
+				map[string]any{"path": "/", "access": "role:approver", "title": "Approvals"},
+			},
+		},
+	}
+	r := testRouter(t, pkg) // testRouter uses nil Teams store
+	w := doGet(r, "/s/role-pkg", "X-User-ID", "user-1")
+	if w.Code != http.StatusForbidden {
+		t.Errorf("expected 403 when Teams store is nil, got %d", w.Code)
+	}
+}