From ed0e12b1b68adf92d4a3e2dd4b5fec744e5e6d0e Mon Sep 17 00:00:00 2001
From: ReLoia <zrennyz@gmail.com>
Date: Wed, 17 Jun 2026 22:27:03 +0200
Subject: [PATCH] feat: add role negation and negate some routes to admins

---
 app/components/Header.vue |  8 ++++----
 app/middleware/auth.ts    |  8 +++++---
 app/pages/reports/new.vue |  3 +++
 app/utils/roles.ts        | 35 +++++++++++++++++++++++++++++++++--
 4 files changed, 45 insertions(+), 9 deletions(-)

diff --git a/app/components/Header.vue b/app/components/Header.vue
index ba024a2..3b07a04 100644
--- a/app/components/Header.vue
+++ b/app/components/Header.vue
@@ -26,15 +26,15 @@ onUnmounted(() => {
   }
 })
 
+const { isAuthenticated, user, logout } = useAuth()
+const panelLabel = computed(() => isAdmin(user.value?.role) ? 'Pannello' : 'Dashboard')
+
 const navLinks = [
   { name: 'Home', path: '/' },
-  { name: 'Fai una segnalazione', path: '/reports/new' },
+  ...(isCitizen(user.value?.role) ? [{ name: 'Fai una segnalazione', path: '/reports/new' }] : []),
   { name: 'Esplora i dati', path: '/open-data' },
   { name: 'Come funziona', path: '/info' }
 ]
-
-const { isAuthenticated, user, logout } = useAuth()
-const panelLabel = computed(() => isAdmin(user.value?.role) ? 'Pannello' : 'Dashboard')
 </script>
 
 <template>
diff --git a/app/middleware/auth.ts b/app/middleware/auth.ts
index 46b3079..e33086f 100644
--- a/app/middleware/auth.ts
+++ b/app/middleware/auth.ts
@@ -1,3 +1,5 @@
+import { checkRoleAccess, type MetaRoleRequirement } from '~/utils/roles'
+
 export default defineNuxtRouteMiddleware(async (to) => {
   const auth = useAuth()
 
@@ -14,13 +16,13 @@ export default defineNuxtRouteMiddleware(async (to) => {
     return navigateTo('/auth/login')
   }
 
-  const requiredRole = to.meta.auth?.role
+  const requiredRole = to.meta.auth?.role as MetaRoleRequirement | undefined
 
   if (requiredRole && auth.user.value) {
     const userRole = auth.user.value.role
 
-    if (!hasMinimumRole(userRole, requiredRole)) {
-      console.warn(`[Auth] User role ${userRole} insufficient for required ${requiredRole}`)
+    if (!checkRoleAccess(userRole, requiredRole)) {
+      console.warn(`[Auth] User role '${userRole}' rejected for route requirement:`, requiredRole)
       return navigateTo('/')
     }
   }
diff --git a/app/pages/reports/new.vue b/app/pages/reports/new.vue
index 6b7e005..d7e3a22 100644
--- a/app/pages/reports/new.vue
+++ b/app/pages/reports/new.vue
@@ -3,6 +3,9 @@ import type { CreateReportRequest } from '~/types/api'
 
 definePageMeta({
   middleware: 'auth',
+  auth: {
+    role: ['!ADMIN', '!OPERATOR']
+  }
 })
 
 useHead({ title: 'Nuova segnalazione - Visione' })
diff --git a/app/utils/roles.ts b/app/utils/roles.ts
index ef77b5c..540c739 100644
--- a/app/utils/roles.ts
+++ b/app/utils/roles.ts
@@ -5,6 +5,8 @@ export const ROLES = {
 } as const
 
 export type Role = keyof typeof ROLES
+export type NegatedRole = `!${Role}`
+export type MetaRoleRequirement = Role | NegatedRole | Array<Role | NegatedRole>
 
 export const ROLE_LEVELS: Record<string, number> = {
   [ROLES.CITIZEN]: 1,
@@ -17,12 +19,12 @@ export function normalizeRole(role?: string | null): string {
 }
 
 export function isRole(userRole: string | undefined | null, targetRole: string): boolean {
-  return normalizeRole(userRole) === targetRole.toUpperCase()
+  return normalizeRole(userRole) === normalizeRole(targetRole)
 }
 
 export function hasMinimumRole(userRole: string | undefined | null, requiredRole: string): boolean {
   const userLvl = ROLE_LEVELS[normalizeRole(userRole)] || 0
-  const reqLvl = ROLE_LEVELS[requiredRole.toUpperCase()] || 0
+  const reqLvl = ROLE_LEVELS[normalizeRole(requiredRole)] || 0
   return userLvl >= reqLvl
 }
 
@@ -41,3 +43,32 @@ export function isCitizen(userRole?: string | null): boolean {
 export function canAccess(userRole: string | undefined | null, requiredRole: string): boolean {
   return hasMinimumRole(userRole, requiredRole)
 }
+
+export function checkRoleAccess(userRole: string | undefined | null, requirement: MetaRoleRequirement | undefined): boolean {
+  if (!requirement) return true
+
+  const normalizedUserRole = normalizeRole(userRole)
+  if (!normalizedUserRole) return false
+
+  const requirements = Array.isArray(requirement) ? requirement : [requirement]
+
+  for (const req of requirements) {
+    const isNegated = req.startsWith('!')
+
+    const rawTarget = isNegated ? req.substring(1) : req
+    const targetRole = normalizeRole(rawTarget)
+
+    if (isNegated) {
+      console.log("negated", normalizedUserRole, targetRole)
+      if (normalizedUserRole === targetRole) {
+        return false
+      }
+    } else {
+      if (!hasMinimumRole(normalizedUserRole, targetRole)) {
+        return false
+      }
+    }
+  }
+
+  return true
+}