service backend

2025-11-07 18:35:26 +01:00
parent 20e8f9acc4
commit 62a6631b9a
537 changed files with 48453 additions and 0 deletions
--- a/api/pkg/auth/dbimp.go
+++ b/api/pkg/auth/dbimp.go
@@ -0,0 +1,319 @@
+package auth
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/tech/sendico/pkg/db/policy"
+	"github.com/tech/sendico/pkg/db/repository"
+	"github.com/tech/sendico/pkg/db/repository/builder"
+	ri "github.com/tech/sendico/pkg/db/repository/index"
+	"github.com/tech/sendico/pkg/db/storable"
+	"github.com/tech/sendico/pkg/db/template"
+	"github.com/tech/sendico/pkg/merrors"
+	"github.com/tech/sendico/pkg/mlogger"
+	"github.com/tech/sendico/pkg/model"
+	"github.com/tech/sendico/pkg/mservice"
+	"github.com/tech/sendico/pkg/mutil/mzap"
+	"go.mongodb.org/mongo-driver/bson/primitive"
+	"go.mongodb.org/mongo-driver/mongo"
+	"go.uber.org/zap"
+)
+
+type ProtectedDBImp[T model.PermissionBoundStorable] struct {
+	DBImp         *template.DBImp[T]
+	Enforcer      Enforcer
+	PermissionRef primitive.ObjectID
+	Collection    mservice.Type
+}
+
+func (db *ProtectedDBImp[T]) enforce(ctx context.Context, action model.Action, object model.PermissionBoundStorable, accountRef, objectRef primitive.ObjectID) error {
+	res, err := db.Enforcer.Enforce(ctx, object.GetPermissionRef(), accountRef, object.GetOrganizationRef(), objectRef, action)
+	if err != nil {
+		db.DBImp.Logger.Warn("Failed to enforce permission",
+			zap.Error(err), mzap.ObjRef("permission_ref", object.GetPermissionRef()),
+			mzap.ObjRef("account_ref", accountRef), mzap.ObjRef("organization_ref", object.GetOrganizationRef()),
+			mzap.ObjRef("object_ref", objectRef), zap.String("action", string(action)))
+		return err
+	}
+	if !res {
+		db.DBImp.Logger.Debug("Access denied", mzap.ObjRef("permission_ref", object.GetPermissionRef()),
+			mzap.ObjRef("account_ref", accountRef), mzap.ObjRef("organization_ref", object.GetOrganizationRef()),
+			mzap.ObjRef("object_ref", objectRef), zap.String("action", string(action)))
+		return merrors.AccessDenied(db.Collection, string(action), objectRef)
+	}
+	return nil
+}
+
+func (db *ProtectedDBImp[T]) Create(ctx context.Context, accountRef, organizationRef primitive.ObjectID, object T) error {
+	db.DBImp.Logger.Debug("Attempting to create object", mzap.ObjRef("account_ref", accountRef),
+		mzap.ObjRef("organization_ref", organizationRef), zap.String("collection", string(db.Collection)))
+
+	if object.GetPermissionRef() == primitive.NilObjectID {
+		object.SetPermissionRef(db.PermissionRef)
+	}
+	object.SetOrganizationRef(organizationRef)
+
+	if err := db.enforce(ctx, model.ActionCreate, object, accountRef, primitive.NilObjectID); err != nil {
+		return err
+	}
+
+	if err := db.DBImp.Create(ctx, object); err != nil {
+		db.DBImp.Logger.Warn("Failed to create object", zap.Error(err), mzap.ObjRef("account_ref", accountRef),
+			mzap.ObjRef("organization_ref", organizationRef), zap.String("collection", string(db.Collection)))
+		return err
+	}
+
+	db.DBImp.Logger.Debug("Successfully created object", mzap.ObjRef("account_ref", accountRef),
+		mzap.ObjRef("organization_ref", organizationRef), zap.String("collection", string(db.Collection)))
+	return nil
+}
+
+func (db *ProtectedDBImp[T]) InsertMany(ctx context.Context, accountRef, organizationRef primitive.ObjectID, objects []T) error {
+	if len(objects) == 0 {
+		return nil
+	}
+
+	db.DBImp.Logger.Debug("Attempting to insert many objects", mzap.ObjRef("account_ref", accountRef),
+		mzap.ObjRef("organization_ref", organizationRef), zap.String("collection", string(db.Collection)),
+		zap.Int("count", len(objects)))
+
+	// Set permission and organization refs for all objects and enforce permissions
+	for _, object := range objects {
+		if object.GetPermissionRef() == primitive.NilObjectID {
+			object.SetPermissionRef(db.PermissionRef)
+		}
+		object.SetOrganizationRef(organizationRef)
+
+		if err := db.enforce(ctx, model.ActionCreate, object, accountRef, primitive.NilObjectID); err != nil {
+			return err
+		}
+	}
+
+	if err := db.DBImp.InsertMany(ctx, objects); err != nil {
+		db.DBImp.Logger.Warn("Failed to insert many objects", zap.Error(err), mzap.ObjRef("account_ref", accountRef),
+			mzap.ObjRef("organization_ref", organizationRef), zap.String("collection", string(db.Collection)),
+			zap.Int("count", len(objects)))
+		return err
+	}
+
+	db.DBImp.Logger.Debug("Successfully inserted many objects", mzap.ObjRef("account_ref", accountRef),
+		mzap.ObjRef("organization_ref", organizationRef), zap.String("collection", string(db.Collection)),
+		zap.Int("count", len(objects)))
+	return nil
+}
+
+func (db *ProtectedDBImp[T]) enforceObject(ctx context.Context, action model.Action, accountRef, objectRef primitive.ObjectID) error {
+	l, err := db.ListIDs(ctx, action, accountRef, repository.IDFilter(objectRef))
+	if err != nil {
+		db.DBImp.Logger.Warn("Error occured while checking access rights", zap.Error(err),
+			mzap.ObjRef("account_ref", accountRef), mzap.ObjRef("object_ref", objectRef), zap.String("action", string(action)))
+		return err
+	}
+	if len(l) == 0 {
+		db.DBImp.Logger.Debug("Access denied", zap.String("action", string(action)), mzap.ObjRef("account_ref", accountRef), mzap.ObjRef("object_ref", objectRef))
+		return merrors.AccessDenied(db.Collection, string(action), objectRef)
+	}
+	return nil
+}
+
+func (db *ProtectedDBImp[T]) Get(ctx context.Context, accountRef, objectRef primitive.ObjectID, result T) error {
+	db.DBImp.Logger.Debug("Attempting to get object", mzap.ObjRef("account_ref", accountRef), mzap.ObjRef("object_ref", objectRef))
+
+	if err := db.enforceObject(ctx, model.ActionRead, accountRef, objectRef); err != nil {
+		return err
+	}
+
+	if err := db.DBImp.Get(ctx, objectRef, result); err != nil {
+		db.DBImp.Logger.Warn("Failed to get object", zap.Error(err), mzap.ObjRef("account_ref", accountRef),
+			mzap.ObjRef("object_ref", objectRef), zap.String("collection", string(db.Collection)))
+		return err
+	}
+
+	db.DBImp.Logger.Debug("Successfully retrieved object",
+		mzap.ObjRef("account_ref", accountRef), mzap.ObjRef("organization_ref", result.GetOrganizationRef()),
+		mzap.StorableRef(result), mzap.ObjRef("permission_ref", result.GetPermissionRef()))
+	return nil
+}
+
+func (db *ProtectedDBImp[T]) Update(ctx context.Context, accountRef primitive.ObjectID, object T) error {
+	db.DBImp.Logger.Debug("Attempting to update object", mzap.ObjRef("account_ref", accountRef), mzap.StorableRef(object))
+
+	if err := db.enforceObject(ctx, model.ActionUpdate, accountRef, *object.GetID()); err != nil {
+		return err
+	}
+
+	if err := db.DBImp.Update(ctx, object); err != nil {
+		db.DBImp.Logger.Warn("Failed to update object", zap.Error(err), mzap.ObjRef("account_ref", accountRef),
+			mzap.ObjRef("organization_ref", object.GetOrganizationRef()), mzap.StorableRef(object))
+		return err
+	}
+
+	db.DBImp.Logger.Debug("Successfully updated object",
+		mzap.ObjRef("account_ref", accountRef), mzap.ObjRef("organization_ref", object.GetOrganizationRef()),
+		mzap.StorableRef(object), mzap.ObjRef("permission_ref", object.GetPermissionRef()))
+	return nil
+}
+
+func (db *ProtectedDBImp[T]) Delete(ctx context.Context, accountRef, objectRef primitive.ObjectID) error {
+	db.DBImp.Logger.Debug("Attempting to delete object",
+		mzap.ObjRef("account_ref", accountRef), mzap.ObjRef("object_ref", objectRef))
+
+	if err := db.enforceObject(ctx, model.ActionDelete, accountRef, objectRef); err != nil {
+		return err
+	}
+
+	if err := db.DBImp.Delete(ctx, objectRef); err != nil {
+		db.DBImp.Logger.Warn("Failed to delete object", zap.Error(err),
+			mzap.ObjRef("account_ref", accountRef), mzap.ObjRef("object_ref", objectRef))
+		return err
+	}
+
+	db.DBImp.Logger.Debug("Successfully deleted object",
+		mzap.ObjRef("account_ref", accountRef), mzap.ObjRef("object_ref", objectRef))
+	return nil
+}
+
+func (db *ProtectedDBImp[T]) ListIDs(
+	ctx context.Context,
+	action model.Action,
+	accountRef primitive.ObjectID,
+	query builder.Query,
+) ([]primitive.ObjectID, error) {
+	db.DBImp.Logger.Debug("Attempting to list object IDs",
+		mzap.ObjRef("account_ref", accountRef), zap.String("collection", string(db.Collection)), zap.Any("filter", query.BuildQuery()))
+
+	// 1. Fetch all candidate IDs from the underlying DB
+	allIDs, err := db.DBImp.ListPermissionBound(ctx, query)
+	if err != nil {
+		db.DBImp.Logger.Warn("Failed to list object IDs", zap.Error(err), mzap.ObjRef("account_ref", accountRef),
+			zap.String("collection", string(db.Collection)), zap.String("action", string(action)))
+		return nil, err
+	}
+	if len(allIDs) == 0 {
+		db.DBImp.Logger.Debug("No objects found matching filter", mzap.ObjRef("account_ref", accountRef),
+			zap.String("collection", string(db.Collection)), zap.Any("filter", query.BuildQuery()))
+		return []primitive.ObjectID{}, merrors.NoData(fmt.Sprintf("no %s found", db.Collection))
+	}
+
+	// 2. Check read permission for each ID
+	var allowedIDs []primitive.ObjectID
+	for _, desc := range allIDs {
+		enforceErr := db.enforce(ctx, action, desc, accountRef, *desc.GetID())
+		if enforceErr == nil {
+			allowedIDs = append(allowedIDs, *desc.GetID())
+		} else if !errors.Is(err, merrors.ErrAccessDenied) {
+			// If the error is something other than AccessDenied, we want to fail
+			db.DBImp.Logger.Warn("Error while enforcing read permission", zap.Error(enforceErr),
+				mzap.ObjRef("permission_ref", desc.GetPermissionRef()), zap.String("action", string(action)),
+				mzap.ObjRef("account_ref", accountRef), mzap.ObjRef("organization_ref", desc.GetOrganizationRef()),
+				mzap.ObjRef("object_ref", *desc.GetID()), zap.String("collection", string(db.Collection)),
+			)
+			return nil, enforceErr
+		}
+		// If AccessDenied, we simply skip that ID.
+	}
+
+	db.DBImp.Logger.Debug("Successfully enforced read permission on IDs", zap.Int("fetched_count", len(allIDs)),
+		zap.Int("allowed_count", len(allowedIDs)), mzap.ObjRef("account_ref", accountRef),
+		zap.String("collection", string(db.Collection)), zap.String("action", string(action)))
+
+	// 3. Return only the IDs that passed permission checks
+	return allowedIDs, nil
+}
+
+func (db *ProtectedDBImp[T]) Unprotected() template.DB[T] {
+	return db.DBImp
+}
+
+func (db *ProtectedDBImp[T]) DeleteCascadeAuth(ctx context.Context, accountRef, objectRef primitive.ObjectID) error {
+	if err := db.enforceObject(ctx, model.ActionDelete, accountRef, objectRef); err != nil {
+		return err
+	}
+	if err := db.DBImp.DeleteCascade(ctx, objectRef); err != nil {
+		db.DBImp.Logger.Warn("Failed to delete dependent object", zap.Error(err))
+		return err
+	}
+	return nil
+}
+
+func CreateDBImp[T model.PermissionBoundStorable](
+	ctx context.Context,
+	l mlogger.Logger,
+	pdb policy.DB,
+	enforcer Enforcer,
+	collection mservice.Type,
+	db *mongo.Database,
+) (*ProtectedDBImp[T], error) {
+	logger := l.Named("protected")
+	var policy model.PolicyDescription
+	if err := pdb.GetBuiltInPolicy(ctx, collection, &policy); err != nil {
+		logger.Warn("Failed to fetch policy description", zap.Error(err), zap.String("resource_type", string(collection)))
+		return nil, err
+	}
+	p := &ProtectedDBImp[T]{
+		DBImp:         template.Create[T](logger, collection, db),
+		PermissionRef: policy.ID,
+		Collection:    collection,
+		Enforcer:      enforcer,
+	}
+	if err := p.DBImp.Repository.CreateIndex(&ri.Definition{
+		Keys: []ri.Key{{Field: storable.OrganizationRefField, Sort: ri.Asc}},
+	}); err != nil {
+		logger.Warn("Failed to create index", zap.Error(err), zap.String("resource_type", string(collection)))
+		return nil, err
+	}
+
+	return p, nil
+}
+
+func (db *ProtectedDBImp[T]) Patch(ctx context.Context, accountRef, objectRef primitive.ObjectID, patch builder.Patch) error {
+	db.DBImp.Logger.Debug("Attempting to patch object",
+		mzap.ObjRef("account_ref", accountRef), mzap.ObjRef("object_ref", objectRef))
+
+	if err := db.enforceObject(ctx, model.ActionUpdate, accountRef, objectRef); err != nil {
+		return err
+	}
+
+	if err := db.DBImp.Repository.Patch(ctx, objectRef, patch); err != nil {
+		db.DBImp.Logger.Warn("Failed to patch object", zap.Error(err),
+			mzap.ObjRef("account_ref", accountRef), mzap.ObjRef("object_ref", objectRef))
+		return err
+	}
+
+	db.DBImp.Logger.Debug("Successfully patched object",
+		mzap.ObjRef("account_ref", accountRef), mzap.ObjRef("object_ref", objectRef))
+	return nil
+}
+
+func (db *ProtectedDBImp[T]) PatchMany(ctx context.Context, accountRef primitive.ObjectID, query builder.Query, patch builder.Patch) (int, error) {
+	db.DBImp.Logger.Debug("Attempting to patch many objects",
+		mzap.ObjRef("account_ref", accountRef), zap.Any("filter", query.BuildQuery()))
+
+	ids, err := db.ListIDs(ctx, model.ActionUpdate, accountRef, query)
+	if err != nil {
+		return 0, err
+	}
+	if len(ids) == 0 {
+		return 0, nil
+	}
+
+	values := make([]any, len(ids))
+	for i, id := range ids {
+		values[i] = id
+	}
+	idFilter := repository.Query().In(repository.IDField(), values...)
+	finalQuery := query.And(idFilter)
+
+	modified, err := db.DBImp.Repository.PatchMany(ctx, finalQuery, patch)
+	if err != nil {
+		db.DBImp.Logger.Warn("Failed to patch many objects", zap.Error(err),
+			mzap.ObjRef("account_ref", accountRef))
+		return 0, err
+	}
+
+	db.DBImp.Logger.Debug("Successfully patched many objects",
+		mzap.ObjRef("account_ref", accountRef), zap.Int("modified_count", modified))
+	return modified, nil
+}