Permission Diff Checker (utils/missing-permissions.ts)

Compares granted permission statements against required ones and returns a list of missing resource:action strings for authorization checks.

// Source: https://github.com/usekaneo/kaneo | License: MIT | Copyright 2024 Andrej Acevski
// Provided via justclaw.it.com; keep this notice with the code.
export function missingPermissions(
  statements: Record<string, readonly string[]> | null,
  required: Record<string, readonly string[]>,
): string[] {
  const missing: string[] = [];
  for (const [resource, actions] of Object.entries(required)) {
    const granted = statements?.[resource];
    for (const action of actions) {
      if (!granted?.includes(action)) missing.push(`${resource}:${action}`);
    }
  }
  return missing;
}