{ "userId": 42, "departmentId": 5, "teamId": 12 }

import { FastifyPluginAsync } from 'fastify';
import { Pool, PoolClient } from 'pg';

export const withAuthorizedClient = (pool: Pool): FastifyPluginAsync => async (app) => {
  app.decorateRequest('db', null);

  app.addHook('preHandler', async (req, _reply) => {
    const userId = Number(req.headers['x-user-id']);
    if (!Number.isFinite(userId)) return;

    const client = await pool.connect();
    await client.query('BEGIN');
    await client.query(
      "SELECT set_config('request.jwt.claims', $1, true)",
      [JSON.stringify({
        userId,
        departmentId: req.user?.departmentId ?? null,
        teamId: req.user?.teamId ?? null
      })]
    );
    (req as any).db = client;
  });

  app.addHook('onResponse', async (req) => {
    const client = (req as any).db as PoolClient | null;
    if (!client) return;
    await client.query('COMMIT').catch(() => client.query('ROLLBACK'));
    client.release();
  });
};

app.post('/ordini/:id/approva', async (req, reply) => {
  const { rows: [{ allowed }] } = await req.db.query(
    "SELECT public.can('ordini', 'approve') AS allowed"
  );
  if (!allowed) return reply.code(403).send({ error: 'forbidden' });

  await req.db.query('UPDATE ordini SET stato = $1 WHERE id = $2', ['approvato', req.params.id]);
  return { ok: true };
});

app.get('/ordini', async (req) => {
  const { rows } = await req.db.query(`
    SELECT o.*
    FROM ordini o
    WHERE public.can_own('ordini', 'read', o.idutentecreazione)
       OR public.can_team('ordini', 'read', o.idteam)
       OR public.can('ordini', 'read')   -- shortcut per scope 'all'
  `);
  return rows;
});

app.get('/permissions/:resource', async (req) => {
  const { rows: [perms] } = await req.db.query(
    'SELECT * FROM public.resource_permissions($1)',
    [req.params.resource]
  );
  return perms;
  // → { can_read_all: false, can_read_dept: false,
  //     can_read_team: true,  can_read_own: true,
  //     can_write_all: false, can_write_dept: false,
  //     can_write_team: true, can_write_own: true,
  //     can_delete_all: false, can_delete_dept: false,
  //     can_delete_team: false, can_delete_own: false }
});

app.get('/me/roles', async (req) => {
  const { rows: roles } = await req.db.query('SELECT * FROM public.get_my_roles()');
  const { rows: [{ admin }] } = await req.db.query(
    "SELECT public.is_admin() AS admin"
  );
  return { admin, roles };
});

CREATE OR REPLACE VIEW public.v_ordini_miei_team
WITH (security_barrier = true) AS
SELECT o.*
FROM public.ordini o
WHERE o.idutentecreazione = public.current_user_id()
   OR o.idteam            = public.current_user_team_id();

CREATE OR REPLACE VIEW public.v_ordini_visibili
WITH (security_barrier = true) AS
SELECT o.*
FROM public.ordini o,
     public.resource_permissions('ordini') p
WHERE p.can_read_all
   OR (p.can_read_dept AND o.iddipartimento     = public.current_user_dept_id())
   OR (p.can_read_team AND o.idteam             = public.current_user_team_id())
   OR (p.can_read_own  AND o.idutentecreazione  = public.current_user_id());

ALTER TABLE public.ordini ENABLE ROW LEVEL SECURITY;

CREATE POLICY p_ordini_select ON public.ordini FOR SELECT USING (
     public.can('ordini', 'read')
  OR public.can_dept('ordini', 'read', iddipartimento)
  OR public.can_team('ordini', 'read', idteam)
  OR public.can_own ('ordini', 'read', idutentecreazione)
);

CREATE POLICY p_ordini_update ON public.ordini FOR UPDATE USING (
     public.can_own('ordini', 'write', idutentecreazione)
  OR public.is_admin()
);

CREATE POLICY p_ordini_delete ON public.ordini FOR DELETE USING (
     public.can('ordini', 'delete')
  OR public.is_admin()
);

CREATE POLICY p_documenti_select ON public.documenti FOR SELECT USING (
     public.has_role('admin')
  OR public.has_role('manager')
  OR (public.has_role('viewer') AND public.can_own('documenti', 'read', idutentecreazione))
);

CREATE OR REPLACE FUNCTION autisti.schedule_corsa(p_idcorsa INTEGER, p_idautista INTEGER)
RETURNS VOID
LANGUAGE plpgsql
AS $$
BEGIN
  IF NOT public.can('autisti', 'schedule') THEN
    RAISE EXCEPTION 'Permesso negato: utente % non puo'' schedulare corse',
      public.current_user_id();
  END IF;

  UPDATE autisti.corse SET idautista = p_idautista WHERE idcorsa = p_idcorsa;
END;
$$;

CREATE OR REPLACE VIEW autisti.v_corse_con_permessi
WITH (security_barrier = true) AS
SELECT
  c.*,
  public.can_own('autisti', 'write',  c.idutentecreazione) AS can_edit,
  public.can_own('autisti', 'delete', c.idutentecreazione) AS can_delete,
  public.can('autisti', 'approve')                          AS can_approve
FROM autisti.corse c
WHERE c.idutentecreazione = public.current_user_id()
   OR c.idteam            = public.current_user_team_id();

// composables/useResourcePermissions.ts
import { ref, computed } from 'vue';
import { apiClient } from '@/services/api';

export interface ResourcePermissions {
  can_read_all: boolean;   can_read_dept: boolean;
  can_read_team: boolean;  can_read_own: boolean;
  can_write_all: boolean;  can_write_dept: boolean;
  can_write_team: boolean; can_write_own: boolean;
  can_delete_all: boolean; can_delete_dept: boolean;
  can_delete_team: boolean; can_delete_own: boolean;
}

export function useResourcePermissions(resource: string) {
  const perms = ref<ResourcePermissions | null>(null);
  const loading = ref(false);

  const load = async () => {
    loading.value = true;
    perms.value = await apiClient.get<ResourcePermissions>(`/permissions/${resource}`);
    loading.value = false;
  };

  const canRead   = computed(() =>
    !!perms.value && (perms.value.can_read_all   || perms.value.can_read_dept ||
                      perms.value.can_read_team  || perms.value.can_read_own));
  const canWrite  = computed(() =>
    !!perms.value && (perms.value.can_write_all  || perms.value.can_write_dept ||
                      perms.value.can_write_team || perms.value.can_write_own));
  const canDelete = computed(() =>
    !!perms.value && (perms.value.can_delete_all || perms.value.can_delete_dept ||
                      perms.value.can_delete_team || perms.value.can_delete_own));

  const readScope = computed<'all'|'department'|'team'|'own'|null>(() => {
    if (!perms.value) return null;
    if (perms.value.can_read_all)  return 'all';
    if (perms.value.can_read_dept) return 'department';
    if (perms.value.can_read_team) return 'team';
    if (perms.value.can_read_own)  return 'own';
    return null;
  });

  load();
  return { perms, loading, canRead, canWrite, canDelete, readScope, reload: load };
}

<script setup lang="ts">
import { useResourcePermissions } from '@/composables/useResourcePermissions';

const props = defineProps<{ ordineId: number; ownerId: number }>();
const { perms } = useResourcePermissions('ordini');
const { user } = useAuth();

const canEdit = computed(() =>
  perms.value?.can_write_all || (perms.value?.can_write_own && props.ownerId === user.value.id)
);
const canDelete = computed(() =>
  perms.value?.can_delete_all || (perms.value?.can_delete_own && props.ownerId === user.value.id)
);
</script>

<template>
  <div class="flex gap-2">
    <button :disabled="!canEdit"
            class="px-3 py-1 rounded bg-blue-600 text-white disabled:bg-gray-300">
      Modifica
    </button>
    <button :disabled="!canDelete"
            class="px-3 py-1 rounded bg-red-600 text-white disabled:bg-gray-300">
      Elimina
    </button>
  </div>
</template>

<script setup lang="ts">
import { useResourcePermissions } from '@/composables/useResourcePermissions';

const { readScope } = useResourcePermissions('ordini');
const { user } = useAuth();

const ordini = ref([]);

watch(readScope, async (scope) => {
  if (!scope) { ordini.value = []; return; }
  const query = {
    all:        {},
    department: { iddipartimento: user.value.departmentId },
    team:       { idteam: user.value.teamId },
    own:        { idutentecreazione: user.value.id }
  }[scope];
  ordini.value = await apiClient.get('/ordini', { params: query });
}, { immediate: true });
</script>

<template>
  <div v-if="readScope === null" class="p-4 bg-red-50 text-red-700 rounded">
    Non hai i permessi per visualizzare gli ordini
  </div>
  <DataTable v-else :rows="ordini" />
</template>

<script setup lang="ts">
const props = defineProps<{ scope: 'all'|'department'|'team'|'own'|null }>();

const label = {
  all:        'Tutti i record',
  department: 'Solo mio dipartimento',
  team:       'Solo mio team',
  own:        'Solo i miei',
  [null as any]: 'Nessun accesso'
};
const color = {
  all:        'bg-green-100 text-green-800',
  department: 'bg-blue-100 text-blue-800',
  team:       'bg-indigo-100 text-indigo-800',
  own:        'bg-yellow-100 text-yellow-800',
  [null as any]: 'bg-red-100 text-red-800'
};
</script>

<template>
  <span :class="['px-2 py-0.5 rounded text-xs font-medium', color[props.scope ?? 'null']]">
    {{ label[props.scope ?? 'null'] }}
  </span>
</template>

// directives/vCan.ts
import type { Directive } from 'vue';
import { useResourcePermissionsCache } from '@/composables/useResourcePermissionsCache';

export const vCan: Directive<HTMLElement, string> = {
  async mounted(el, binding) {
    const [resource, action] = binding.value.split(':');
    const perms = await useResourcePermissionsCache().get(resource);
    const allowed =
      perms[`can_${action}_all`]  || perms[`can_${action}_dept`] ||
      perms[`can_${action}_team`] || perms[`can_${action}_own`];

    if (!allowed) {
      if (binding.modifiers.disable) el.setAttribute('disabled', 'true');
      else el.style.display = 'none';
    }
  }
};

<button v-can="'ordini:write'">Nuovo ordine</button>
<button v-can.disable="'ordini:delete'">Elimina selezionati</button>