RBAC-matrix

import { auth } from "@/auth"
import { can } from "@/lib/authz"
 
export async function PATCH(req, { params }) {
  const session = await auth()
  if (!session) return new Response("Unauthorized", { status: 401 })
 
  const assignment = await db.assignment.findUnique({
    where: { id: params.id },
    select: { organizationId: true, departmentId: true, userId: true },
  })
  if (!assignment) return new Response("Not Found", { status: 404 })
 
  const allowed = can(session, "edit", {
    type: "assignment",
    ...assignment,
  })
  if (!allowed) return new Response("Forbidden", { status: 403 })
 
  // ... write
}