1480255
use sea_orm::{ColumnTrait, Condition, EntityTrait, QueryFilter, TransactionTrait};
use serde::{Deserialize, Serialize};
use time::OffsetDateTime;
use utoipa::{IntoParams, ToSchema};
use uuid::Uuid;
use models::space::space_join_rules::{self, Entity as JoinRules};
use models::space::{SpaceJoinTrigger, space_member_roles, space_roles};
use crate::authority;
use crate::errors::SpaceError;
use crate::services::service::SpaceService;
use crate::services::types::JoinRuleSummary;
use crate::share::authz::{MANAGE_ROLES, require_perm};
use crate::share::lookup;
pub const MAX_JOIN_RULE_MATCHER_LEN: usize = 64;
#[derive(Debug, Clone, Serialize, Deserialize, ToSchema)]
pub struct JoinRuleDto {
pub id: Uuid,
pub role_id: Uuid,
pub trigger: SpaceJoinTrigger,
pub matcher: String,
pub enabled: bool,
pub created_at: OffsetDateTime,
pub updated_at: OffsetDateTime,
}
impl From<JoinRuleSummary> for JoinRuleDto {
fn from(row: JoinRuleSummary) -> Self {
Self {
id: row.id,
role_id: row.role_id,
trigger: SpaceJoinTrigger::from_str(&row.trigger),
matcher: row.matcher,
enabled: row.enabled,
created_at: authority::to_time(row.created_at),
updated_at: authority::to_time(row.updated_at),
}
}
}
#[derive(Debug, Clone, Deserialize, ToSchema)]
pub struct CreateJoinRuleCmd {
pub role_id: Uuid,
#[serde(default)]
pub trigger: SpaceJoinTrigger,
#[serde(default)]
pub matcher: String,
}
#[derive(Debug, Clone, Deserialize, ToSchema)]
pub struct UpdateJoinRuleCmd {
pub enabled: Option<bool>,
pub matcher: Option<String>,
}
#[derive(Debug, Clone, Deserialize, IntoParams, ToSchema)]
pub struct JoinRulePath {
pub space_name: String,
pub rule_id: Uuid,
}
fn normalize_matcher(raw: &str) -> Result<String, SpaceError> {
let matcher = raw.trim().to_string();
if matcher.chars().count() > MAX_JOIN_RULE_MATCHER_LEN {
return Err(SpaceError::BadRequest(format!(
"join rule matcher must be at most {MAX_JOIN_RULE_MATCHER_LEN} characters"
)));
}
Ok(matcher)
}
/// Public entry point consumed by action sources (e.g. lib/issues reactions).
/// Grants the configured role for every enabled, matching join rule of the space.
/// Idempotent: an already bound role is left untouched.
pub async fn apply_space_join_rules(
access: &crate::Access,
space_id: Uuid,
user_id: i64,
trigger: SpaceJoinTrigger,
matcher: &str,
) -> Result<(), SpaceError> {
let matcher = matcher.trim();
let rules = JoinRules::find()
.filter(space_join_rules::Column::OrganizationId.eq(space_id))
.filter(space_join_rules::Column::Trigger.eq(trigger.as_str()))
.filter(space_join_rules::Column::Enabled.eq(true))
.filter(
Condition::any()
.add(space_join_rules::Column::Matcher.eq(""))
.add(space_join_rules::Column::Matcher.eq(matcher)),
)
.all(access.database.read())
.await?;
if rules.is_empty() {
return Ok(());
}
let Some(member) =
crate::services::member::find_any(access.database.read(), space_id, user_id).await?
else {
return Ok(());
};
if member.status() != models::space::MemberStatus::Active {
return Ok(());
}
let txn = access.database.write().begin().await?;
let mut bound = false;
for rule in &rules {
let role = space_roles::Entity::find_by_id(rule.role_id)
.filter(space_roles::Column::OrganizationId.eq(space_id))
.one(&txn)
.await?;
let Some(role) = role else {
continue;
};
let existing = space_member_roles::Entity::find()
.filter(space_member_roles::Column::MemberId.eq(member.id))
.filter(space_member_roles::Column::RoleId.eq(role.id))
.one(&txn)
.await?;
if existing.is_some() {
continue;
}
crate::services::role::bind_role(&txn, member.id, role.id, user_id).await?;
bound = true;
}
if bound {
crate::services::service::bump_version(&txn, space_id).await?;
}
txn.commit().await?;
if bound {
crate::services::permission::invalidate(&access.database, &access.cache, space_id).await?;
}
Ok(())
}
impl SpaceService {
#[tracing::instrument(name = "space.create_join_rule", skip_all, fields(caller = %caller, space = %space_name))]
pub async fn create_join_rule(
&self,
caller: i64,
space_name: &str,
cmd: CreateJoinRuleCmd,
) -> Result<JoinRuleDto, SpaceError> {
let space = lookup::lookup_space_by_name(self, space_name).await?;
require_perm(self, &space, caller, MANAGE_ROLES).await?;
let matcher = normalize_matcher(&cmd.matcher)?;
let rule = self
.admin_create_join_rule(
caller,
space.id,
cmd.role_id,
cmd.trigger.as_str().to_string(),
matcher,
true,
None,
)
.await?;
Ok(rule.into())
}
#[tracing::instrument(name = "space.update_join_rule", skip_all, fields(caller = %caller, space = %space_name, rule_id = %rule_id))]
pub async fn update_join_rule(
&self,
caller: i64,
space_name: &str,
rule_id: Uuid,
cmd: UpdateJoinRuleCmd,
) -> Result<JoinRuleDto, SpaceError> {
let space = lookup::lookup_space_by_name(self, space_name).await?;
require_perm(self, &space, caller, MANAGE_ROLES).await?;
let matcher = match cmd.matcher {
Some(raw) => Some(normalize_matcher(&raw)?),
None => None,
};
let rule = self
.admin_update_join_rule(
caller,
space.id,
rule_id,
None,
None,
matcher,
cmd.enabled,
None,
)
.await?;
Ok(rule.into())
}
#[tracing::instrument(name = "space.delete_join_rule", skip_all, fields(caller = %caller, space = %space_name, rule_id = %rule_id))]
pub async fn delete_join_rule(
&self,
caller: i64,
space_name: &str,
rule_id: Uuid,
) -> Result<(), SpaceError> {
let space = lookup::lookup_space_by_name(self, space_name).await?;
require_perm(self, &space, caller, MANAGE_ROLES).await?;
if !self
.admin_delete_join_rule(caller, space.id, rule_id, None)
.await?
{
return Err(SpaceError::NotFound);
}
Ok(())
}
pub async fn list_join_rules(
&self,
caller: i64,
space_name: &str,
) -> Result<Vec<JoinRuleDto>, SpaceError> {
let space = lookup::lookup_space_by_name(self, space_name).await?;
require_perm(self, &space, caller, MANAGE_ROLES).await?;
let rows = self.admin_list_join_rules(caller, space.id, None).await?;
Ok(rows.into_iter().map(JoinRuleDto::from).collect())
}
}