Feat admin rbac migration (#1)

Co-authored-by: Jeffrey Smith <jasafpro@gmail.com>
Co-committed-by: Jeffrey Smith <jasafpro@gmail.com>

server/middleware/admin.go

@@ -4,14 +4,19 @@ import (
 	"net/http"
 
 	"github.com/gin-gonic/gin"
+
+	"switchboard-core/auth"
+	"switchboard-core/store"
 )
 
-// RequireAdmin returns middleware that restricts access to admin users.
-// Must be used after Auth() middleware which sets "role" in context.
-func RequireAdmin() gin.HandlerFunc {
+// RequireAdmin returns middleware that restricts access to users with the
+// surface.admin.access permission (i.e. members of the Admins group).
+// Must be used after Auth() middleware which sets "user_id" in context.
+func RequireAdmin(stores store.Stores) gin.HandlerFunc {
 	return func(c *gin.Context) {
-		role, exists := c.Get("role")
-		if !exists || role != "admin" {
+		userID := c.GetString("user_id")
+		perms, err := resolveAndCachePerms(c, stores, userID)
+		if err != nil || !perms[auth.PermSurfaceAdminAccess] {
 			c.AbortWithStatusJSON(http.StatusForbidden, gin.H{
 				"error": "admin access required",
 			})