add bundler stuff

web/auth/permissions.ts

@@ -0,0 +1,13 @@
+// Generic permission check shared by the framework. The permission CONSTANTS
+// (P_APP_*, P_ORG_*, ...) are application-specific and live app-side; only this
+// membership test is generic. "*" (P_ALL) grants everything.
+export const P_ALL = "*";
+
+export function hasPermission(
+    permissions: string[] | null | undefined,
+    permission: string,
+): boolean {
+    if (!permissions) return false;
+    if (permissions.includes(P_ALL)) return true;
+    return permissions.includes(permission);
+}