a06673b
use std::collections::HashSet;
use db::conn::sea_orm::*;
use db::space::space_bans as ban_entity;
use db::space::space_member_roles as member_role_entity;
use db::space::space_members as member_entity;
use db::space::space_role_permissions as role_perm_entity;
use db::space::spaces as space_entity;
use time::OffsetDateTime;
use uuid::Uuid;
use crate::error::{SpaceError, SpaceResult};
use crate::features::SpaceService;
pub const VIEW_SPACE: &str = "view_space";
pub const READ: &str = "read";
pub const MESSAGE: &str = "message";
pub const MANAGE_MEMBERS: &str = "manage_members";
pub const MANAGE_ROLES: &str = "manage_roles";
pub const MANAGE_INVITES: &str = "manage_invites";
pub const MANAGE_BANS: &str = "manage_bans";
pub const MANAGE_CHANNELS: &str = "manage_channels";
pub const MANAGE_OVERWRITES: &str = "manage_overwrites";
#[derive(Debug, Clone, Default)]
pub struct Permissions {
granted: HashSet<String>,
}
impl Permissions {
fn all() -> Self {
Self {
granted: [
VIEW_SPACE,
READ,
MESSAGE,
MANAGE_MEMBERS,
MANAGE_ROLES,
MANAGE_INVITES,
MANAGE_BANS,
MANAGE_CHANNELS,
MANAGE_OVERWRITES,
]
.iter()
.map(ToString::to_string)
.collect(),
}
}
pub fn has(&self, action: &str) -> bool {
self.granted.contains(action)
}
}
/// Resolve the caller's effective permissions for a space.
///
/// - Space owner always holds every permission.
/// - A non-expired ban denies access regardless of membership.
/// - Otherwise the caller must be an active member; permissions are the union
/// of all permissions granted by the roles assigned to the caller.
pub async fn effective_permissions<C>(
db: &C,
space_id: Uuid,
user_id: Uuid,
) -> SpaceResult<(space_entity::Model, Permissions)>
where
C: ConnectionTrait,
{
let space = space_entity::Entity::find_by_id(space_id)
.one(db)
.await?
.ok_or_else(|| SpaceError::NotFound(format!("space {space_id}")))?;
if space.owner_id == user_id {
return Ok((space, Permissions::all()));
}
let now = OffsetDateTime::now_utc();
let ban = ban_entity::Entity::find_by_id((space_id, user_id)).one(db).await?;
if let Some(b) = ban
&& b.expires_at.is_none_or(|exp| exp > now)
{
return Err(SpaceError::Forbidden(
"caller is banned from this space".to_string(),
));
}
let member = member_entity::Entity::find_by_id((space_id, user_id)).one(db).await?;
let active = member
.map(|m| m.status == member_entity::MemberStatus::Active)
.unwrap_or(false);
if !active {
return Err(SpaceError::Forbidden(
"caller is not an active member of this space".to_string(),
));
}
let role_rows = member_role_entity::Entity::find()
.filter(member_role_entity::Column::SpaceId.eq(space_id))
.filter(member_role_entity::Column::UserId.eq(user_id))
.all(db)
.await?;
let role_ids: Vec<Uuid> = role_rows.into_iter().map(|r| r.role_id).collect();
if role_ids.is_empty() {
return Ok((space, Permissions::default()));
}
let perm_rows = role_perm_entity::Entity::find()
.filter(role_perm_entity::Column::RoleId.is_in(role_ids))
.all(db)
.await?;
let granted = perm_rows.into_iter().map(|r| r.permission).collect();
Ok((space, Permissions { granted }))
}
/// Require a specific permission for `caller` on `space_id`.
pub async fn require_perm(
svc: &SpaceService,
caller: Uuid,
space_id: Uuid,
action: &str,
) -> SpaceResult<space_entity::Model> {
let db = svc.db.reader();
let (space, perms) = effective_permissions(&db, space_id, caller).await?;
if !perms.has(action) {
return Err(SpaceError::Forbidden(format!(
"caller lacks permission `{action}` for space {space_id}"
)));
}
Ok(space)
}