Centralize resource authorization decisions

client/src/api/quadcoachApi/domain/ResourceAuthorization.ts

@@ -0,0 +1,22 @@
+export type ResourceAccessLevel = "view" | "edit";
+
+export type ResourceAuthorizationBasis =
+  | "owner"
+  | "admin"
+  | "granted"
+  | "public";
+
+export type ResourceAuthorizationResponse = {
+  hasAccess: boolean;
+  type: ResourceAuthorizationBasis | null;
+  level: ResourceAccessLevel | null;
+};
+
+export const canEditResource = (
+  authorization: ResourceAuthorizationResponse | undefined,
+): boolean => authorization?.level === "edit";
+
+export const canManageResource = (
+  authorization: ResourceAuthorizationResponse | undefined,
+): boolean =>
+  authorization?.type === "owner" || authorization?.type === "admin";

client/src/api/quadcoachApi/domain/index.ts

@@ -11,3 +11,9 @@ export type {
   TacticBoardPartialId,
 } from "./TacticBoard";
 export type { default as User, UserWithOutId, UserPartialId } from "./User";
+export type {
+  ResourceAccessLevel,
+  ResourceAuthorizationBasis,
+  ResourceAuthorizationResponse,
+} from "./ResourceAuthorization";
+export { canEditResource, canManageResource } from "./ResourceAuthorization";

client/src/api/quadcoachApi/practicePlansApi.ts

@@ -6,7 +6,12 @@ import type {
   PracticePlanSection,
   PracticePlanHeader,
 } from "./domain/PracticePlan";
-import { AccessLevel } from "./tacticboardApi";
+import type {
+  ResourceAccessLevel,
+  ResourceAuthorizationResponse,
+} from "./domain";
+
+export type AccessLevel = ResourceAccessLevel;
 
 export interface CreatePracticePlanRequest {
   name: string;
@@ -32,12 +37,6 @@ export type PracticePlanAccessEntry = {
   createdAt: string;
 };
 
-export type AccessResponse = {
-  hasAccess: boolean;
-  type: "owner" | "admin" | "granted" | null;
-  level: AccessLevel | null;
-};
-
 export type ShareLinkResponse = {
   message: string;
   token: string;
@@ -184,6 +183,18 @@ export const practicePlansApiSlice = quadcoachApi.injectEndpoints({
       }),
       invalidatesTags: [TagType.practiceplan],
     }),
+    checkPracticePlanAccess: builder.query<
+      ResourceAuthorizationResponse,
+      string
+    >({
+      query: (practicePlanId) => ({
+        url: `/api/practice-plans/${practicePlanId}/checkAccess`,
+        method: "get",
+      }),
+      providesTags: (_result, _error, practicePlanId) => [
+        { type: TagType.practiceplan, id: `${practicePlanId}-access` },
+      ],
+    }),
     getAllPracticePlanAccessUsers: builder.query<
       PracticePlanAccessEntry[],
       string
@@ -264,6 +275,7 @@ export const {
   useGetSharedPracticePlanQuery,
   usePatchPracticePlanMutation,
   useDeletePracticePlanMutation,
+  useCheckPracticePlanAccessQuery,
   useGetAllPracticePlanAccessUsersQuery,
   useAddPracticePlanAccessMutation,
   useRemovePracticePlanAccessMutation,

client/src/api/quadcoachApi/tacticboardApi.ts

@@ -1,6 +1,11 @@
 import { quadcoachApi } from "..";
 import { TagType } from "../enum";
-import { TacticBoard, TacticPage } from "./domain";
+import {
+  ResourceAccessLevel,
+  ResourceAuthorizationResponse,
+  TacticBoard,
+  TacticPage,
+} from "./domain";
 import { TacticBoardWithOutIds } from "./domain/TacticBoard";
 import { TacticBoardHeader } from "./domain/TacticBoard";
 
@@ -35,7 +40,7 @@ export type GetTacticBoardResponse = {
   };
 };
 
-export type AccessLevel = "view" | "edit";
+export type AccessLevel = ResourceAccessLevel;
 
 export type AccessEntry = {
   user: {
@@ -47,12 +52,6 @@ export type AccessEntry = {
   createdAt: string;
 };
 
-export type AccessResponse = {
-  hasAccess: boolean;
-  type: "owner" | "admin" | "granted" | null;
-  level: AccessLevel | null;
-};
-
 export type ShareLinkResponse = {
   message: string;
   token: string;
@@ -364,7 +363,10 @@ export const tacticBoardApiSlice = quadcoachApi.injectEndpoints({
             ]
           : [TagType.tacticboard],
     }),
-    checkTacticboardAccess: builder.query<AccessResponse, string>({
+    checkTacticboardAccess: builder.query<
+      ResourceAuthorizationResponse,
+      string
+    >({
       query: (tacticboardId) => ({
         url: `/api/tacticboards/${tacticboardId}/checkAccess`,
         method: "get",

client/src/pages/Exercises/Exercise/ViewExercise/Exercise.tsx

@@ -28,6 +28,7 @@ import {
   useGetAllExerciseAccessUsersQuery,
   useShareExerciseMutation,
   useDeleteExerciseAccessMutation,
+  useCheckExerciseAccessQuery,
 } from "../../../exerciseApi";
 import { useTranslation } from "react-i18next";
 import {
@@ -50,7 +51,12 @@ import {
   useRemoveFavoriteExerciseMutation,
 } from "../../../../api/quadcoachApi/favoriteApi";
 
-import { ExercisePartialId, Block } from "../../../../api/quadcoachApi/domain";
+import {
+  Block,
+  canEditResource,
+  canManageResource,
+  ExercisePartialId,
+} from "../../../../api/quadcoachApi/domain";
 import {
   FormikProvider,
   useFormik,
@@ -71,8 +77,7 @@ const Exercise = () => {
   const { t } = useTranslation("Exercise");
   const { id: exerciseId } = useParams();
   const navigate = useNavigate();
-  const [isPrivileged, setIsPrivileged] = useState<boolean>(false);
-  const { id: userId, roles: userRoles } = useAuth();
+  const { id: userId } = useAuth();
   const [isFavorite, setIsFavorite] = useState<boolean>(false);
   const [userEmail, setUserEmail] = useState<string>("");
   const [emailError, setEmailError] = useState<string>("");
@@ -114,16 +119,17 @@ const Exercise = () => {
   const [getFavoriteExercises, { data: favoriteExercises }] =
     useLazyGetFavoriteExercisesQuery();
 
+  const { data: authorization } = useCheckExerciseAccessQuery(
+    exerciseId || "",
+    { skip: !exerciseId || !userId },
+  );
+  const canEdit = canEditResource(authorization);
+  const canManageResourceActions = canManageResource(authorization);
   const { data: accessUsers } = useGetAllExerciseAccessUsersQuery(
     exerciseId || "",
-    { skip: !exerciseId },
+    { skip: !exerciseId || !canManageResourceActions },
   );
 
-  const isCreator =
-    exercise?.user?.toString() === userId ||
-    userRoles.includes("Admin") ||
-    userRoles.includes("admin");
-
   const [shareExercise, { isLoading: isShareExerciseLoading }] =
     useShareExerciseMutation();
 
@@ -153,27 +159,6 @@ const Exercise = () => {
     }
   }, [favoriteExercises, setIsFavorite, exerciseId]);
 
-  useEffect(() => {
-    if (!userId) {
-      setIsPrivileged(false);
-      return;
-    }
-    if (isCreator) {
-      setIsPrivileged(true);
-      return;
-    }
-    if (
-      accessUsers &&
-      accessUsers.some(
-        (entry) => entry.user._id === userId && entry.access === "edit",
-      )
-    ) {
-      setIsPrivileged(true);
-    } else {
-      setIsPrivileged(false);
-    }
-  }, [userId, isCreator, accessUsers]);
-
   // Add update exercise mutation
   const [
     updateExercise,
@@ -289,7 +274,7 @@ const Exercise = () => {
   // Auto-enter edit mode if URL has ?edit=1 and user is privileged (runs after formik init)
   useEffect(() => {
     if (autoEditAppliedRef.current) return;
-    if (!isEditMode && isPrivileged) {
+    if (!isEditMode && canEdit) {
       const params = new URLSearchParams(location.search);
       if (params.get("edit") === "1") {
         autoEditAppliedRef.current = true;
@@ -305,11 +290,11 @@ const Exercise = () => {
         autoEditAppliedRef.current = true; // no edit flag; avoid re-checking
       }
     }
-  }, [location.search, isPrivileged, isEditMode, formik, location.pathname]);
+  }, [location.search, canEdit, isEditMode, formik, location.pathname]);
 
   // Edit mode toggle functionality
   const onToggleEditMode = async () => {
-    if (!isPrivileged) return;
+    if (!canEdit) return;
     if (isEditMode) {
       const errors = await formik.validateForm();
       if (Object.keys(errors).length === 0) {
@@ -454,7 +439,7 @@ const Exercise = () => {
 
   const exerciseMenuActions: HeaderOverflowAction[] = [];
 
-  if (isPrivileged) {
+  if (canManageResourceActions) {
     exerciseMenuActions.push({
       key: "delete",
       label: t("Exercise:menu.delete"),
@@ -511,7 +496,7 @@ const Exercise = () => {
               </IconButton>
             </Tooltip>
           )}
-          {isPrivileged && (
+          {canEdit && (
             <Tooltip
               title={t("Exercise:updateExercise", {
                 context: isEditMode ? "editMode" : "viewMode",
@@ -565,7 +550,7 @@ const Exercise = () => {
               />
             </Tooltip>
           ),
-          isPrivileged && (
+          canEdit && (
             <Tooltip
               key="edit"
               title={t("Exercise:updateExercise", {
@@ -727,7 +712,7 @@ const Exercise = () => {
             />
           )}
 
-          {isEditMode && isCreator && (
+          {isEditMode && canManageResourceActions && (
             <Accordion defaultExpanded>
               <AccordionSummary expandIcon={<ExpandMoreIcon />}>
                 {t("Exercise:access.title")}