gamma-enterprise-rbac

# Gamma Enterprise RBAC ## Overview Implement role-based access control for Gamma API integrations. Gamma's API uses a single API key per workspace -- granular permissions must be implemented in your application layer. The Teams and Business plans support workspace-level collaboration with shared themes and folders. ## Prerequisites - Gamma Teams or Business subscription - Application database for user/role storage - Completed `gamma-install-auth` setup ## Gamma Access Model ``` Gamma Workspace (1 API key) ├── Themes (shared across workspace) ├── Folders (shared across workspace) └── Generations (tied to API key, not individual users) Your Application Layer (you implement this): ├── Organization │ ├── Admin (manage API key, configure themes) │ ├── Editor (generate presentations, use templates) │ ├── Viewer (view generated presentations, download exports) │ └── Guest (no generation access) ``` **Key point:** Gamma's API does not have per-user authentication. All API calls use the workspace API key. You must enforce per-user permissions in your application. ## Instructions ### Step 1: Define Role Hierarchy ```typescript // src/auth/gamma-roles.ts type GammaRole = "guest" | "viewer" | "editor" | "admin"; const PERMISSIONS: Record<GammaRole, string[]> = { guest: [], viewer: ["generation:view", "export:download"], editor: ["generation:view", "generation:create", "export:download", "template:use"], admin: [ "generation:view", "generation:create", "ex...