`lib/accounts.ts`

22 lines
/**
 * Hub account capabilities — three guest tiers alongside the admin login,
 * built on the shared @dw/nextjs-admin-login capability layer (v0.3.0).
 *
 *   guest  — member: can write, no AI, no admin-only controls.
 *   viewer — fully read-only.
 *   demo   — read-only data, AI features usable (Hub has no AI routes today,
 *            so this tier behaves like viewer here; kept for fleet consistency).
 *
 * A tier is only an active login when its password env var is set. Enforced
 * authoritatively in middleware via capabilityGate.
 */
import { createCapabilityRegistry } from '@dw/nextjs-admin-login';

export const registry = createCapabilityRegistry({
  guests: {
    guest:  { role: 'member', displayName: 'Guest',              canWrite: true,  canUseAI: false, passwordEnv: 'HUB_GUEST_PASSWORD' },
    viewer: { role: 'viewer', displayName: 'Viewer (read-only)', canWrite: false, canUseAI: false, passwordEnv: 'HUB_VIEWER_PASSWORD' },
    demo:   { role: 'viewer', displayName: 'Demo',               canWrite: false, canUseAI: true,  passwordEnv: 'HUB_DEMO_PASSWORD' },
  },
});