export const departmentAccessTool = createTool({
id: 'department-access-tool',
description: 'Validate department-specific access and permissions',
inputSchema: z.object({
resource: z.string(),
operation: z.enum(['read', 'write', 'delete'])
}),
execute: async ({ resource, operation, runtimeContext }) => {
const cometchatContext = runtimeContext.get('cometchatContext');
const { sender, messageMetadata } = cometchatContext;
// Multi-level validation checks
const {
departmentId,
customPermissions,
sessionContext,
organizationId
} = messageMetadata;
// Department-based access control
const resourceDepartmentMap = {
'financial_reports': ['finance', 'executive'],
'hr_documents': ['hr', 'management'],
'product_data': ['engineering', 'product', 'marketing']
};
const allowedDepartments = resourceDepartmentMap[resource];
if (!allowedDepartments?.includes(departmentId)) {
return {
error: `Access denied. Resource '${resource}' not available to department '${departmentId}'`,
allowedDepartments
};
}
// Operation-specific permission check
const requiredPermission = `${operation}_${resource}`;
if (!customPermissions?.includes(requiredPermission)) {
return {
error: `Insufficient permissions for '${operation}' on '${resource}'`,
requiredPermission,
userPermissions: customPermissions
};
}
// Time-based access (business hours check)
const userTimezone = sessionContext?.timezone || 'UTC';
const currentHour = new Date().toLocaleString('en-US', {
timeZone: userTimezone,
hour12: false,
hour: 'numeric'
});
if (resource === 'financial_reports' && (currentHour < 9 || currentHour > 17)) {
return {
error: 'Financial reports only accessible during business hours (9 AM - 5 PM)',
currentTime: currentHour,
timezone: userTimezone
};
}
// Language localization check
const userLanguage = sessionContext?.language || 'en';
const supportedLanguages = ['en', 'es', 'fr', 'de'];
if (!supportedLanguages.includes(userLanguage)) {
return {
warning: `Content may not be available in '${userLanguage}'. Defaulting to English.`,
defaultLanguage: 'en'
};
}
// All validations passed
return {
access: 'granted',
resource,
operation,
userId: sender.uid,
departmentId,
timestamp: new Date().toISOString(),
language: userLanguage
};
}
});