Check a secret’s user-defined roles

// Defines the `RoleCheck` collection.
// The collection will contain a document for each
// user-defined role.
collection RoleCheck {
  // Defines the `byName()` index.
  // Use the index to get `RoleCheck` collection documents by
  // their `name`.
  index byName {
     terms [.name]
  }
}

// Defines the `currentRoles()` UDF.
// Return an Array of user-defined roles.
// Ex: ["customer", "manager"]
function currentRoles() {
  RoleCheck.all().map(.name).toArray()
}

// Defines the `hasRole()` UDF.
// Takes a role as an argument. Returns `true` or `false`.
function hasRole(role) {
  RoleCheck.byName(role) != null
}

// Gets all user-defined roles as an Array.
let roles = Role.all().toArray()

// Creates a `RoleCheck` collection document for
// each role in the previous Array.
roles.map(role => {
  RoleCheck.create({ name: role.name })
})

// Gets all user-defined roles as an Array.
let roles = Role.all().toArray()

// Adds privileges for the new collection and UDFs to each role
// in the previous Array.
roles.map(role => {
  let newPrivileges = role.privileges.concat([
    { resource: "RoleCheck", actions: { read: "doc => doc.name == '#{role.name}'" } },
    { resource: "hasRole", actions: { call: true } },
    { resource: "currentRoles", actions: { call: true } }
  ])

  role.update({ privileges: newPrivileges })
})

// Secret with the built-in `admin` role.
currentRoles()      // ["customer", "manager"]
hasRole("customer") // true
hasRole("manager")  // true

// Secret with the user-defined `customer` role.
currentRoles()      // ["customer"]
hasRole("customer") // true
hasRole("manager")  // false

// Secret with the user-defined `manager` role.
currentRoles()      // ["manager"]
hasRole("customer") // false
hasRole("manager")  // true