Who may see what is decided on the server

import { defineRoles, f, resource } from '@protobase/schema'

export const roles = defineRoles({
  admin: ['*'],
  desk: [
    'work_orders.read', 'work_orders.create', 'work_orders.update',
    'money.read',
  ],
  mechanic: ['work_orders.read.own', 'work_orders.update.own'],
})

export const workOrders = resource('work_orders')
  .table('shop.work_orders')
  .fields({
    id: f.integer().readOnly().filterable().sortable().dbDefault(),
    assignee: f.text().filterable(),
    task: f.text(),
    status: f.enum(['open', 'done']).default('open').filterable(),
    // Only roles holding money.read see the price of the labour.
    labour: f.decimal({ precision: 8, scale: 2 }).access({
      read: roles.can('money.read'),
      update: roles.is('admin'),
    }),
  })
  .primaryKey((r) => r.id)
  // .own capabilities match the rows assigned to the signed-in user.
  .owner((r) => r.assignee)
  .access({
    // A finished work order is closed, checked against the stored row.
    update: roles.can('work_orders.update').and(
      (_ctx, record) => (record as { status: string }).status !== 'done',
    ),
    delete: roles.is('admin'),
  })