feat(rbac): add roles and permissions

frontend/athena/lib/permissions.ts

@@ -0,0 +1,19 @@
+import type { CurrentUser, PermissionName } from "@/types/rbac";
+
+export function hasPermission(user: CurrentUser | null | undefined, permission: PermissionName) {
+  return Boolean(user?.permissions.includes(permission));
+}
+
+export function hasAnyPermission(
+  user: CurrentUser | null | undefined,
+  permissions: PermissionName[],
+) {
+  return permissions.some((permission) => hasPermission(user, permission));
+}
+
+export function hasAllPermissions(
+  user: CurrentUser | null | undefined,
+  permissions: PermissionName[],
+) {
+  return permissions.every((permission) => hasPermission(user, permission));
+}

frontend/athena/lib/server/hermes-proxy.ts

@@ -0,0 +1,55 @@
+import { NextRequest } from "next/server";
+
+import {
+  clearAuthCookie,
+  getAccessToken,
+  getHermesUrl,
+  hermesJsonResponse,
+  unauthorizedResponse,
+  upstreamConfigurationErrorResponse,
+  upstreamUnavailableResponse,
+} from "@/lib/server/hermes";
+
+export async function proxyHermesRequest(
+  request: NextRequest,
+  path: string,
+) {
+  const token = await getAccessToken();
+
+  if (!token) {
+    return unauthorizedResponse();
+  }
+
+  const hermesUrl = getHermesUrl();
+
+  if (!hermesUrl) {
+    return upstreamConfigurationErrorResponse();
+  }
+
+  let hermesResponse: Response;
+
+  try {
+    hermesResponse = await fetch(`${hermesUrl}${path}`, {
+      method: request.method,
+      headers: {
+        Authorization: `Bearer ${token}`,
+        Accept: "application/json",
+        "Content-Type": "application/json",
+      },
+      body: request.method === "GET" || request.method === "DELETE"
+        ? undefined
+        : await request.text(),
+      cache: "no-store",
+    });
+  } catch {
+    return upstreamUnavailableResponse();
+  }
+
+  if (hermesResponse.status === 401) {
+    const response = await hermesJsonResponse(hermesResponse);
+    clearAuthCookie(response);
+    return response;
+  }
+
+  return hermesJsonResponse(hermesResponse);
+}