authkit/service_authz.go

package authkit

import (
	"context"

	"git.juancwu.dev/juancwu/errx"
	"github.com/google/uuid"
)

// AssignRole assigns roleSlug to userID. Idempotent — a duplicate insert
// is a no-op via ON CONFLICT.
func (a *Auth) AssignRole(ctx context.Context, userID uuid.UUID, roleSlug string) error {
	const op = "authkit.Auth.AssignRole"
	r, err := a.storeGetRoleBySlug(ctx, roleSlug)
	if err != nil {
		return errx.Wrap(op, err)
	}
	if err := a.storeAssignRoleToUser(ctx, userID, r.ID); err != nil {
		return errx.Wrap(op, err)
	}
	return nil
}

// RemoveRole removes roleSlug from userID. Idempotent on missing
// assignments.
func (a *Auth) RemoveRole(ctx context.Context, userID uuid.UUID, roleSlug string) error {
	const op = "authkit.Auth.RemoveRole"
	r, err := a.storeGetRoleBySlug(ctx, roleSlug)
	if err != nil {
		return errx.Wrap(op, err)
	}
	if err := a.storeRemoveRoleFromUser(ctx, userID, r.ID); err != nil {
		return errx.Wrap(op, err)
	}
	return nil
}

// UserRoles returns the role slugs assigned to a user.
func (a *Auth) UserRoles(ctx context.Context, userID uuid.UUID) ([]string, error) {
	const op = "authkit.Auth.UserRoles"
	roles, err := a.storeGetUserRoles(ctx, userID)
	if err != nil {
		return nil, errx.Wrap(op, err)
	}
	out := make([]string, len(roles))
	for i, r := range roles {
		out[i] = r.Slug
	}
	return out, nil
}

// HasRole reports whether the user holds the named role.
func (a *Auth) HasRole(ctx context.Context, userID uuid.UUID, slug string) (bool, error) {
	const op = "authkit.Auth.HasRole"
	ok, err := a.storeHasAnyRole(ctx, userID, []string{slug})
	if err != nil {
		return false, errx.Wrap(op, err)
	}
	return ok, nil
}

// HasAnyRole reports whether the user holds at least one of the named roles.
func (a *Auth) HasAnyRole(ctx context.Context, userID uuid.UUID, slugs []string) (bool, error) {
	const op = "authkit.Auth.HasAnyRole"
	ok, err := a.storeHasAnyRole(ctx, userID, slugs)
	if err != nil {
		return false, errx.Wrap(op, err)
	}
	return ok, nil
}

// GrantPermissionToUser adds a direct permission grant (not through any
// role). Idempotent.
func (a *Auth) GrantPermissionToUser(ctx context.Context, userID uuid.UUID, permSlug string) error {
	const op = "authkit.Auth.GrantPermissionToUser"
	p, err := a.storeGetPermissionBySlug(ctx, permSlug)
	if err != nil {
		return errx.Wrap(op, err)
	}
	if err := a.storeGrantPermissionToUser(ctx, userID, p.ID); err != nil {
		return errx.Wrap(op, err)
	}
	return nil
}

// RevokePermissionFromUser removes a direct permission grant.
func (a *Auth) RevokePermissionFromUser(ctx context.Context, userID uuid.UUID, permSlug string) error {
	const op = "authkit.Auth.RevokePermissionFromUser"
	p, err := a.storeGetPermissionBySlug(ctx, permSlug)
	if err != nil {
		return errx.Wrap(op, err)
	}
	if err := a.storeRevokePermissionFromUser(ctx, userID, p.ID); err != nil {
		return errx.Wrap(op, err)
	}
	return nil
}

// UserPermissions returns the union of permission slugs the user holds via
// roles and direct grants.
func (a *Auth) UserPermissions(ctx context.Context, userID uuid.UUID) ([]string, error) {
	const op = "authkit.Auth.UserPermissions"
	perms, err := a.storeGetUserPermissions(ctx, userID)
	if err != nil {
		return nil, errx.Wrap(op, err)
	}
	out := make([]string, len(perms))
	for i, p := range perms {
		out[i] = p.Slug
	}
	return out, nil
}

// HasPermission reports whether the user holds the named permission, via
// any combination of role-derived and direct grants.
func (a *Auth) HasPermission(ctx context.Context, userID uuid.UUID, permSlug string) (bool, error) {
	const op = "authkit.Auth.HasPermission"
	perms, err := a.UserPermissions(ctx, userID)
	if err != nil {
		return false, errx.Wrap(op, err)
	}
	for _, p := range perms {
		if p == permSlug {
			return true, nil
		}
	}
	return false, nil
}