memind/security-baseline.mjs

import {
  catalogKeys,
  DEFAULT_USER_CAPABILITIES,
  USER_NON_GRANTABLE_CAPABILITIES,
} from './capabilities.mjs';
import { DEFAULT_USER_POLICIES, policyKeys } from './policies.mjs';

export function productionRoleCapabilities() {
  return {
    ...DEFAULT_USER_CAPABILITIES,
    context_memory: false,
    memory_store: false,
    chat_recall: false,
    charts: false,
    todo: false,
    image_read: true,
  };
}

export function productionRolePolicies() {
  return { ...DEFAULT_USER_POLICIES };
}

export async function applyRoleSecurityBaseline(pool, role = 'user') {
  const now = Date.now();
  const capabilities = productionRoleCapabilities();
  for (const key of catalogKeys()) {
    const allowed = USER_NON_GRANTABLE_CAPABILITIES.has(key)
      ? false
      : Boolean(capabilities[key]);
    await pool.query(
      `INSERT INTO h5_capability_grants (subject_type, subject_id, capability_key, allowed, updated_at)
       VALUES ('role', ?, ?, ?, ?)
       ON DUPLICATE KEY UPDATE allowed = VALUES(allowed), updated_at = VALUES(updated_at)`,
      [role, key, allowed ? 1 : 0, now],
    );
  }

  const policies = productionRolePolicies();
  for (const key of policyKeys()) {
    await pool.query(
      `INSERT INTO h5_user_policies (subject_type, subject_id, policy_key, policy_value, updated_at)
       VALUES ('role', ?, ?, ?, ?)
       ON DUPLICATE KEY UPDATE policy_value = VALUES(policy_value), updated_at = VALUES(updated_at)`,
      [role, key, String(policies[key]), now],
    );
  }
}

export async function clearUserPermissionOverrides(pool) {
  await pool.query(`DELETE FROM h5_capability_grants WHERE subject_type = 'user'`);
  await pool.query(`DELETE FROM h5_user_policies WHERE subject_type = 'user'`);
}

export async function applyProductionSecurityBaseline(pool) {
  await applyRoleSecurityBaseline(pool, 'user');
  await clearUserPermissionOverrides(pool);
}