V13-FE-006: consolidate approved UI and contract hardening

docs/Design/kbx-foundation-v60-status-canonical-contract-hardening/apps/web/src/permissions/authorizationPolicy.ts

@@ -0,0 +1,11 @@
+import { kbxAiAuthorizationPolicy, kbxPermissionCatalog, kbxSensitiveDataPolicies, type KbxAiCapability } from '@kbx/contracts'
+const byId = new Map(kbxPermissionCatalog.map(x => [x.id, x]))
+export function getKbxPermission(id:string){ return byId.get(id) }
+export function canKbx(granted:readonly string[], permission:string){ return granted.includes(permission) }
+export function kbxAiCapabilities(granted:readonly string[], screenAllowed:readonly KbxAiCapability[]=['explain','suggest','draft']):KbxAiCapability[]{
+  if(!canKbx(granted,kbxAiAuthorizationPolicy.usePermission)) return []
+  const result=screenAllowed.filter(x=>x!=='execute')
+  if(screenAllowed.includes('execute') && canKbx(granted,kbxAiAuthorizationPolicy.executePermission)) result.push('execute')
+  return result
+}
+export function getSensitivePolicyForField(fieldKey:string){ return kbxSensitiveDataPolicies.find(p=>p.fields.includes(fieldKey as never)) }

docs/Design/kbx-foundation-v60-status-canonical-contract-hardening/apps/web/src/permissions/permissionContext.ts

@@ -0,0 +1,10 @@
+import type { KbxPermissionContext } from '@kbx/contracts'
+
+export function createPermissionContext(granted: Iterable<string>): KbxPermissionContext {
+  const permissions = new Set(granted)
+  return {
+    has: permission => permissions.has(permission),
+    hasAny: required => required.some(x => permissions.has(x)),
+    hasAll: required => required.every(x => permissions.has(x)),
+  }
+}