eintopf.info@v0.13.16/service/notification/authorizer.go

// Copyright (C) 2024 The Eintopf authors
//
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU Affero General Public License as
// published by the Free Software Foundation, either version 3 of the
// License, or (at your option) any later version.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
// GNU Affero General Public License for more details.
//
// You should have received a copy of the GNU Affero General Public License
// along with this program.  If not, see <https://www.gnu.org/licenses/>.

package notification

import (
	"context"
	"fmt"

	"eintopf.info/internal/crud"
	"eintopf.info/service/auth"
)

type Authorizer struct {
	store Storer
}

// NewAuthorizer wraps the given store with authorization methods.
func NewAuthorizer(store Storer) *Authorizer {
	return &Authorizer{store: store}
}

// Create is allowed by
//   - an admin
//   - a moderator
//   - internally
func (a *Authorizer) Create(ctx context.Context, notification *NewNotification) (*Notification, error) {
	role, err := auth.RoleFromContext(ctx)
	if err != nil {
		return nil, auth.ErrUnauthorized
	}
	if role == auth.RoleNormal {
		return nil, auth.ErrUnauthorized
	}
	return a.store.Create(ctx, notification)
}

// Update is allowed by
//   - the user owning the notification
//   - an admin
//   - internally
func (a *Authorizer) Update(ctx context.Context, notification *Notification) (*Notification, error) {
	if err := a.adminOrOwned(ctx, notification.ID); err != nil {
		return nil, err
	}

	return a.store.Update(ctx, notification)
}

// Delete is allowed by
//   - the user owning the notification
//   - an admin
//   - internally
func (a *Authorizer) Delete(ctx context.Context, id string) error {
	if err := a.adminOrOwned(ctx, id); err != nil {
		return err
	}

	return a.store.Delete(ctx, id)
}

// FindByID is allowed by
//   - the user owning the notification
//   - an admin
//   - internally
func (a *Authorizer) FindByID(ctx context.Context, id string) (*Notification, error) {
	if err := a.adminOrOwned(ctx, id); err != nil {
		return nil, err
	}

	return a.store.FindByID(ctx, id)
}

// Find is allowed by
//   - normal and moderator for notifications that are owned
//   - an admin
//   - internally
func (a *Authorizer) Find(ctx context.Context, params *crud.FindParams[Filters]) ([]*Notification, int, error) {
	notifications, total, err := a.store.Find(ctx, params)
	if err != nil {
		return nil, 0, err
	}

	role, err := auth.RoleFromContext(ctx)
	if err != nil {
		return nil, 0, auth.ErrUnauthorized
	}
	if role == auth.RoleAdmin || role == auth.RoleInternal {
		return notifications, total, nil
	}

	userID, err := auth.UserIDFromContext(ctx)
	if err != nil {
		return nil, 0, auth.ErrUnauthorized
	}

	filtered := []*Notification{}
	for _, n := range notifications {
		if n.UserID == userID {
			filtered = append(filtered, n)
		} else {
			total--
		}
	}
	return filtered, total, nil
}

func (a *Authorizer) adminOrOwned(ctx context.Context, id string) error {
	role, err := auth.RoleFromContext(ctx)
	if err != nil {
		return auth.ErrUnauthorized
	}
	if role == auth.RoleNormal || role == auth.RoleModerator {
		userID, err := auth.UserIDFromContext(ctx)
		if err != nil {
			return auth.ErrUnauthorized
		}

		n, err := a.store.FindByID(auth.ContextWithRole(ctx, auth.RoleInternal), id)
		if err != nil {
			return err
		}
		if n == nil {
			return fmt.Errorf("could not find existing notification")
		}

		if n.UserID != userID {
			return auth.ErrUnauthorized
		}
	}
	return nil
}

type SettingsAuthorizer struct {
	store SettingsStorer
}

// NewSettingsAuthorizer wraps the given store with authorization methods.
func NewSettingsAuthorizer(store SettingsStorer) *SettingsAuthorizer {
	return &SettingsAuthorizer{store: store}
}

// Create is allowed by
//   - the user owning the settings
//   - an admin
//   - internally
func (a *SettingsAuthorizer) Create(ctx context.Context, settings *NewSettings) (*Settings, error) {
	if err := a.adminOrOwned(ctx, settings.UserID); err != nil {
		return nil, err
	}
	return a.store.Create(ctx, settings)
}

// Update is allowed by
//   - the user owning the settings
//   - an admin
//   - internally
func (a *SettingsAuthorizer) Update(ctx context.Context, settings *Settings) (*Settings, error) {
	if err := a.adminOrOwned(ctx, settings.UserID); err != nil {
		return nil, err
	}

	return a.store.Update(ctx, settings)
}

// Delete is allowed by
//   - the user owning the settings
//   - an admin
//   - internally
func (a *SettingsAuthorizer) Delete(ctx context.Context, id string) error {
	if err := a.adminOrOwned(ctx, id); err != nil {
		return err
	}

	return a.store.Delete(ctx, id)
}

// FindByID is allowed by
//   - the user owning the settings
//   - an admin
//   - internally
func (a *SettingsAuthorizer) FindByID(ctx context.Context, id string) (*Settings, error) {
	if err := a.adminOrOwned(ctx, id); err != nil {
		return nil, err
	}

	return a.store.FindByID(ctx, id)
}

// Find is allowed by
//   - normal and moderator can only retrieve their own settings
//   - an admin
//   - internally
func (a *SettingsAuthorizer) Find(ctx context.Context, params *crud.FindParams[SettingsFilters]) ([]*Settings, int, error) {
	role, err := auth.RoleFromContext(ctx)
	if err != nil {
		return nil, 0, auth.ErrUnauthorized
	}
	if role == auth.RoleNormal || role == auth.RoleModerator {
		if params == nil {
			params = &crud.FindParams[SettingsFilters]{}
		}
		if params.Filters == nil {
			params.Filters = &SettingsFilters{}
		}
		id, err := auth.UserIDFromContext(ctx)
		if err != nil {
			return nil, 0, auth.ErrUnauthorized
		}
		params.Filters.UserID = &id
	}

	return a.store.Find(ctx, params)
}

func (a *SettingsAuthorizer) adminOrOwned(ctx context.Context, id string) error {
	role, err := auth.RoleFromContext(ctx)
	if err != nil {
		return auth.ErrUnauthorized
	}
	if role == auth.RoleNormal || role == auth.RoleModerator {
		userID, err := auth.UserIDFromContext(ctx)
		if err != nil {
			return auth.ErrUnauthorized
		}

		if id != userID {
			return auth.ErrUnauthorized
		}
	}
	return nil
}