Permissions

Server-side roles check

If you import @workspace/auth/permissions you have following helpers:

• isOrganizationOwner(userId, organizationId)
• isOrganizationAdmin(userId, organizationId)
• isOrganizationMember(userId, organizationId)

You can check the permission for the active organization on the server-side like following:

import { getAuthOrganizationContext } from '@workspace/auth/context';
import { isOrganizationAdmin } from '@workspace/auth/permissions';

const ctx = await getAuthOrganizationContext();
const isAdmin = await isOrganizationAdmin(
  ctx.session.user.id,
  ctx.organization.id
);

Please not that you can pass in any userId or organizationId, it doesn't have to be from a session context.

Client-side roles check

The profile object of the getProfile() server-side call returns the active organization permissions:

type ActiveOrganizationPermissions = { isOwner: boolean; role: Role };

The values are transient and not cached. Passing the profile object to any client component enables you to do permission checks on the client.

Accessing memberships

On the server-side the context object has all the current user's memberships.

const memberships = ctx.session.user.memberships;

The same pattern for the active's organization memberships.

const memberships = ctx.organization.memberships;

You can check the active organization memberships on the client using:

'use client';

import { useActiveOrganization } from '~/hooks/use-active-organization';

export function ClientComponent() {
  const activeOrganization = useActiveOrganization();
  const memberships = activeOrganization.memberships;
}