Policies refactor, guest roles (#6732)

server/policies/webhookSubscription.ts

@@ -1,35 +1,15 @@
 import { User, Team, WebhookSubscription } from "@server/models";
 import { allow } from "./cancan";
+import { and, isTeamAdmin, isTeamMutable } from "./utils";
 
-allow(User, "listWebhookSubscription", Team, (user, team) => {
-  if (!team || user.isViewer || user.teamId !== team.id) {
-    return false;
-  }
-
-  return user.isAdmin;
-});
-
-allow(User, "createWebhookSubscription", Team, (user, team) => {
-  if (!team || user.isViewer || user.teamId !== team.id) {
-    return false;
-  }
-
-  return user.isAdmin;
-});
-
-allow(
-  User,
-  ["read", "update", "delete"],
-  WebhookSubscription,
-  (user, webhook): boolean => {
-    if (!user || !webhook) {
-      return false;
-    }
-
-    if (!user.isAdmin) {
-      return false;
-    }
-
-    return user.teamId === webhook.teamId;
-  }
+allow(User, "createWebhookSubscription", Team, (actor, team) =>
+  and(
+    //
+    isTeamAdmin(actor, team),
+    isTeamMutable(actor)
+  )
 );
+
+allow(User, "listWebhookSubscription", Team, isTeamAdmin);
+
+allow(User, ["read", "update", "delete"], WebhookSubscription, isTeamAdmin);