Skip to content
sendou.ink docs

Tournament · Permissions

3 modules · 24 exports · 4 repositories · 23 e2e tests · 12 routes

Who may do what in Tournament: the per-object permissions it builds with every place checking them, and the checks in its code. See Permissions for how authorization works and the reference for every role and feature.

Granted here

Built at read time into what the functions return, a list of the user ids holding each permission. Checks are listed wherever they are, other features' included.

PermissionGranted byChecked in
ADMIN
findById → organizerPermissions
ADMIN = R.unique([args.authorId, ...membersWithRole(["ADMIN"])])
Either sideTournament.ts
ORGANIZE
findById → organizerPermissions
ORGANIZE = R.unique([
	...ADMIN,
	...membersWithRole(["ORGANIZER"]),
	...staffWithRole(["ORGANIZER"]),
])
Serverto.$id.server.tsTournament.server.ts ×3
Either sideTournament.ts
MANAGE_MATCHES
findById → organizerPermissions
MANAGE_MATCHES = R.unique([
	...ORGANIZE,
	...membersWithRole(["STREAMER"]),
	...staffWithRole(["STREAMER"]),
])
Either sideTournament.ts
EDIT_EVENT_INFO
findById → permissionsOf
R.unique([
	tournament.author.id,
	...organizationMembers
		.filter(
			(member) =>
				member.role === "ADMIN" &&
				(isEstablished ||
					Boolean(member.isTournamentOrganizer) ||
					isSupporter(member)),
		)
		.map((member) => member.userId),
])
Servercalendar.new.server.ts
Either sideTournament.ts
EDIT_IN_GAME_NAMES
findById → permissionsOf
isEstablished
	? membersWithRole(["ADMIN", "ORGANIZER"])
	: []
Either sideTournament.ts

Outside the system

Reading x.permissions.NAME directly skips hasPermission and with it the admin bypass, and authorizing an action on an object with isAdmin and friends is a bug. Some of these are deliberate, the permissions doc lists the boundaries.