service backend

api/pkg/auth/dbimpab.go

@@ -0,0 +1,420 @@
+package auth
+
+import (
+	"context"
+	"errors"
+
+	"github.com/tech/sendico/pkg/db/policy"
+	"github.com/tech/sendico/pkg/db/repository"
+	"github.com/tech/sendico/pkg/db/repository/builder"
+	"github.com/tech/sendico/pkg/db/template"
+	"github.com/tech/sendico/pkg/merrors"
+	"github.com/tech/sendico/pkg/mlogger"
+	"github.com/tech/sendico/pkg/model"
+	"github.com/tech/sendico/pkg/mservice"
+	"github.com/tech/sendico/pkg/mutil/mzap"
+	"go.mongodb.org/mongo-driver/bson/primitive"
+	"go.mongodb.org/mongo-driver/mongo"
+	"go.uber.org/zap"
+)
+
+type AccountBoundDBImp[T model.AccountBoundStorable] struct {
+	Logger        mlogger.Logger
+	DBImp         *template.DBImp[T]
+	Enforcer      Enforcer
+	PermissionRef primitive.ObjectID
+	Collection    mservice.Type
+}
+
+func (db *AccountBoundDBImp[T]) enforce(ctx context.Context, action model.Action, object model.AccountBoundStorable, accountRef primitive.ObjectID) error {
+	// FIRST: Check if the object's AccountRef equals the calling accountRef - if so, ALLOW
+	objectAccountRef := object.GetAccountRef()
+	if objectAccountRef != nil && *objectAccountRef == accountRef {
+		db.Logger.Debug("Access granted - object belongs to calling account",
+			mzap.ObjRef("object_account_ref", *objectAccountRef),
+			mzap.ObjRef("calling_account_ref", accountRef),
+			zap.String("action", string(action)))
+		return nil
+	}
+
+	// SECOND: If not owned by calling account, check organization-level permissions
+	organizationRef := object.GetOrganizationRef()
+	res, err := db.Enforcer.Enforce(ctx, db.PermissionRef, accountRef, organizationRef, organizationRef, action)
+	if err != nil {
+		db.Logger.Warn("Failed to enforce permission",
+			zap.Error(err), mzap.ObjRef("permission_ref", db.PermissionRef),
+			mzap.ObjRef("account_ref", accountRef), mzap.ObjRef("organization_ref", organizationRef),
+			zap.String("action", string(action)))
+		return err
+	}
+	if !res {
+		db.Logger.Debug("Access denied", mzap.ObjRef("permission_ref", db.PermissionRef),
+			mzap.ObjRef("account_ref", accountRef), mzap.ObjRef("organization_ref", organizationRef),
+			zap.String("action", string(action)))
+		return merrors.AccessDenied(db.Collection, string(action), primitive.NilObjectID)
+	}
+	return nil
+}
+
+func (db *AccountBoundDBImp[T]) enforceInterface(ctx context.Context, action model.Action, object model.AccountBoundStorable, accountRef primitive.ObjectID) error {
+	// FIRST: Check if the object's AccountRef equals the calling accountRef - if so, ALLOW
+	objectAccountRef := object.GetAccountRef()
+	if objectAccountRef != nil && *objectAccountRef == accountRef {
+		db.Logger.Debug("Access granted - object belongs to calling account",
+			mzap.ObjRef("object_account_ref", *objectAccountRef),
+			mzap.ObjRef("calling_account_ref", accountRef),
+			zap.String("action", string(action)))
+		return nil
+	}
+
+	// SECOND: If not owned by calling account, check organization-level permissions
+	organizationRef := object.GetOrganizationRef()
+	res, err := db.Enforcer.Enforce(ctx, db.PermissionRef, accountRef, organizationRef, organizationRef, action)
+	if err != nil {
+		db.Logger.Warn("Failed to enforce permission",
+			zap.Error(err), mzap.ObjRef("permission_ref", db.PermissionRef),
+			mzap.ObjRef("account_ref", accountRef), mzap.ObjRef("organization_ref", organizationRef),
+			zap.String("action", string(action)))
+		return err
+	}
+	if !res {
+		db.Logger.Debug("Access denied", mzap.ObjRef("permission_ref", db.PermissionRef),
+			mzap.ObjRef("account_ref", accountRef), mzap.ObjRef("organization_ref", organizationRef),
+			zap.String("action", string(action)))
+		return merrors.AccessDenied(db.Collection, string(action), primitive.NilObjectID)
+	}
+	return nil
+}
+
+func (db *AccountBoundDBImp[T]) Create(ctx context.Context, accountRef primitive.ObjectID, object T) error {
+	orgRef := object.GetOrganizationRef()
+	db.Logger.Debug("Attempting to create object", mzap.ObjRef("account_ref", accountRef),
+		mzap.ObjRef("organization_ref", orgRef), zap.String("collection", string(db.Collection)))
+
+	// Check organization update permission for create operations
+	if err := db.enforce(ctx, model.ActionUpdate, object, accountRef); err != nil {
+		return err
+	}
+
+	if err := db.DBImp.Create(ctx, object); err != nil {
+		db.Logger.Warn("Failed to create object", zap.Error(err), mzap.ObjRef("account_ref", accountRef),
+			mzap.ObjRef("organization_ref", orgRef), zap.String("collection", string(db.Collection)))
+		return err
+	}
+
+	db.Logger.Debug("Successfully created object", mzap.ObjRef("account_ref", accountRef),
+		mzap.ObjRef("organization_ref", orgRef), zap.String("collection", string(db.Collection)))
+	return nil
+}
+
+func (db *AccountBoundDBImp[T]) Get(ctx context.Context, accountRef, objectRef primitive.ObjectID, result T) error {
+	db.Logger.Debug("Attempting to get object", mzap.ObjRef("account_ref", accountRef), mzap.ObjRef("object_ref", objectRef))
+
+	// First get the object to check its organization
+	if err := db.DBImp.Get(ctx, objectRef, result); err != nil {
+		db.Logger.Warn("Failed to get object", zap.Error(err), mzap.ObjRef("account_ref", accountRef),
+			mzap.ObjRef("object_ref", objectRef), zap.String("collection", string(db.Collection)))
+		return err
+	}
+
+	// Check organization read permission
+	if err := db.enforce(ctx, model.ActionRead, result, accountRef); err != nil {
+		return err
+	}
+
+	db.Logger.Debug("Successfully retrieved object", mzap.ObjRef("account_ref", accountRef),
+		mzap.ObjRef("organization_ref", result.GetOrganizationRef()), zap.String("collection", string(db.Collection)))
+	return nil
+}
+
+func (db *AccountBoundDBImp[T]) Update(ctx context.Context, accountRef primitive.ObjectID, object T) error {
+	db.Logger.Debug("Attempting to update object", mzap.ObjRef("account_ref", accountRef), mzap.StorableRef(object))
+
+	// Check organization update permission
+	if err := db.enforce(ctx, model.ActionUpdate, object, accountRef); err != nil {
+		return err
+	}
+
+	if err := db.DBImp.Update(ctx, object); err != nil {
+		db.Logger.Warn("Failed to update object", zap.Error(err), mzap.ObjRef("account_ref", accountRef),
+			mzap.ObjRef("organization_ref", object.GetOrganizationRef()), mzap.StorableRef(object))
+		return err
+	}
+
+	db.Logger.Debug("Successfully updated object", mzap.ObjRef("account_ref", accountRef),
+		mzap.ObjRef("organization_ref", object.GetOrganizationRef()), mzap.StorableRef(object))
+	return nil
+}
+
+func (db *AccountBoundDBImp[T]) Patch(ctx context.Context, accountRef, objectRef primitive.ObjectID, patch builder.Patch) error {
+	db.Logger.Debug("Attempting to patch object", mzap.ObjRef("account_ref", accountRef), mzap.ObjRef("object_ref", objectRef))
+
+	// First get the object to check its organization
+	objs, err := db.DBImp.Repository.ListAccountBound(ctx, repository.IDFilter(objectRef))
+	if err != nil {
+		db.Logger.Warn("Failed to get object for permission check when deleting", zap.Error(err), mzap.ObjRef("object_ref", objectRef))
+		return err
+	}
+	if len(objs) == 0 {
+		db.Logger.Debug("Permission denied for deletion", mzap.ObjRef("object_ref", objectRef), mzap.ObjRef("account_ref", accountRef))
+		return merrors.AccessDenied(db.Collection, string(model.ActionDelete), objectRef)
+	}
+
+	// Check organization update permission
+	if err := db.enforce(ctx, model.ActionUpdate, objs[0], accountRef); err != nil {
+		return err
+	}
+
+	if err := db.DBImp.Patch(ctx, objectRef, patch); err != nil {
+		db.Logger.Warn("Failed to patch object", zap.Error(err), mzap.ObjRef("account_ref", accountRef),
+			mzap.ObjRef("object_ref", objectRef), zap.String("collection", string(db.Collection)))
+		return err
+	}
+
+	db.Logger.Debug("Successfully patched object", mzap.ObjRef("account_ref", accountRef), mzap.ObjRef("object_ref", objectRef))
+	return nil
+}
+
+func (db *AccountBoundDBImp[T]) Delete(ctx context.Context, accountRef, objectRef primitive.ObjectID) error {
+	db.Logger.Debug("Attempting to delete object", mzap.ObjRef("account_ref", accountRef), mzap.ObjRef("object_ref", objectRef))
+
+	// First get the object to check its organization
+	objs, err := db.DBImp.Repository.ListAccountBound(ctx, repository.IDFilter(objectRef))
+	if err != nil {
+		db.Logger.Warn("Failed to get object for permission check when deleting", zap.Error(err), mzap.ObjRef("object_ref", objectRef))
+		return err
+	}
+	if len(objs) == 0 {
+		db.Logger.Debug("Permission denied for deletion", mzap.ObjRef("object_ref", objectRef), mzap.ObjRef("account_ref", accountRef))
+		return merrors.AccessDenied(db.Collection, string(model.ActionDelete), objectRef)
+	}
+	// Check organization update permission for delete operations
+	if err := db.enforce(ctx, model.ActionUpdate, objs[0], accountRef); err != nil {
+		return err
+	}
+
+	if err := db.DBImp.Delete(ctx, objectRef); err != nil {
+		db.Logger.Warn("Failed to delete object", zap.Error(err), mzap.ObjRef("account_ref", accountRef),
+			mzap.ObjRef("object_ref", objectRef), zap.String("collection", string(db.Collection)))
+		return err
+	}
+
+	db.Logger.Debug("Successfully deleted object", mzap.ObjRef("account_ref", accountRef), mzap.ObjRef("object_ref", objectRef))
+	return nil
+}
+
+func (db *AccountBoundDBImp[T]) DeleteMany(ctx context.Context, accountRef primitive.ObjectID, query builder.Query) error {
+	db.Logger.Debug("Attempting to delete many objects", mzap.ObjRef("account_ref", accountRef), zap.String("collection", string(db.Collection)))
+
+	// Get all candidate objects for batch permission checking
+	allObjects, err := db.DBImp.Repository.ListPermissionBound(ctx, query)
+	if err != nil {
+		db.Logger.Warn("Failed to list objects for delete many", zap.Error(err), mzap.ObjRef("account_ref", accountRef))
+		return err
+	}
+
+	// Use batch enforcement for efficiency
+	allowedResults, err := db.Enforcer.EnforceBatch(ctx, allObjects, accountRef, model.ActionUpdate)
+	if err != nil {
+		db.Logger.Warn("Failed to enforce batch permissions for delete many", zap.Error(err), mzap.ObjRef("account_ref", accountRef))
+		return err
+	}
+
+	// Build query for objects that passed permission check
+	var allowedIDs []primitive.ObjectID
+	for _, obj := range allObjects {
+		if allowedResults[*obj.GetID()] {
+			allowedIDs = append(allowedIDs, *obj.GetID())
+		}
+	}
+
+	if len(allowedIDs) == 0 {
+		db.Logger.Debug("No objects allowed for deletion", mzap.ObjRef("account_ref", accountRef))
+		return nil
+	}
+
+	// Delete only the allowed objects
+	allowedQuery := query.And(repository.Query().In(repository.IDField(), allowedIDs))
+	if err := db.DBImp.DeleteMany(ctx, allowedQuery); err != nil {
+		db.Logger.Warn("Failed to delete many objects", zap.Error(err), mzap.ObjRef("account_ref", accountRef))
+		return err
+	}
+
+	db.Logger.Debug("Successfully deleted many objects", mzap.ObjRef("account_ref", accountRef), zap.Int("count", len(allowedIDs)))
+	return nil
+}
+
+func (db *AccountBoundDBImp[T]) FindOne(ctx context.Context, accountRef primitive.ObjectID, query builder.Query, result T) error {
+	db.Logger.Debug("Attempting to find one object", mzap.ObjRef("account_ref", accountRef), zap.String("collection", string(db.Collection)))
+
+	// For FindOne, we need to check read permission after finding the object
+	if err := db.DBImp.FindOne(ctx, query, result); err != nil {
+		db.Logger.Warn("Failed to find one object", zap.Error(err), mzap.ObjRef("account_ref", accountRef))
+		return err
+	}
+
+	// Check organization read permission for the found object
+	if err := db.enforce(ctx, model.ActionRead, result, accountRef); err != nil {
+		return err
+	}
+
+	db.Logger.Debug("Successfully found one object", mzap.ObjRef("account_ref", accountRef),
+		mzap.ObjRef("organization_ref", result.GetOrganizationRef()))
+	return nil
+}
+
+func (db *AccountBoundDBImp[T]) ListIDs(ctx context.Context, accountRef primitive.ObjectID, query builder.Query) ([]primitive.ObjectID, error) {
+	db.Logger.Debug("Attempting to list object IDs", mzap.ObjRef("account_ref", accountRef), zap.String("collection", string(db.Collection)))
+
+	// Get all candidate objects for batch permission checking
+	allObjects, err := db.DBImp.Repository.ListPermissionBound(ctx, query)
+	if err != nil {
+		db.Logger.Warn("Failed to list objects for ID filtering", zap.Error(err), mzap.ObjRef("account_ref", accountRef))
+		return nil, err
+	}
+
+	// Use batch enforcement for efficiency
+	allowedResults, err := db.Enforcer.EnforceBatch(ctx, allObjects, accountRef, model.ActionRead)
+	if err != nil {
+		db.Logger.Warn("Failed to enforce batch permissions for ID listing", zap.Error(err), mzap.ObjRef("account_ref", accountRef))
+		return nil, err
+	}
+
+	// Filter to only allowed object IDs
+	var allowedIDs []primitive.ObjectID
+	for _, obj := range allObjects {
+		if allowedResults[*obj.GetID()] {
+			allowedIDs = append(allowedIDs, *obj.GetID())
+		}
+	}
+
+	db.Logger.Debug("Successfully filtered object IDs", zap.Int("total_count", len(allObjects)),
+		zap.Int("allowed_count", len(allowedIDs)), mzap.ObjRef("account_ref", accountRef))
+	return allowedIDs, nil
+}
+
+func (db *AccountBoundDBImp[T]) ListAccountBound(ctx context.Context, accountRef, organizationRef primitive.ObjectID, query builder.Query) ([]model.AccountBoundStorable, error) {
+	db.Logger.Debug("Attempting to list account bound objects", mzap.ObjRef("account_ref", accountRef), zap.String("collection", string(db.Collection)))
+
+	// Build query to find objects where accountRef matches OR is null/absent
+	accountQuery := repository.WithOrg(accountRef, organizationRef)
+
+	// Combine with the provided query
+	finalQuery := query.And(accountQuery)
+
+	// Get all candidate objects
+	allObjects, err := db.DBImp.Repository.ListAccountBound(ctx, finalQuery)
+	if err != nil {
+		db.Logger.Warn("Failed to list account bound objects", zap.Error(err), mzap.ObjRef("account_ref", accountRef))
+		return nil, err
+	}
+
+	// Filter objects based on read permissions (AccountBoundStorable doesn't have permission info, so we check organization level)
+	var allowedObjects []model.AccountBoundStorable
+	for _, obj := range allObjects {
+		if err := db.enforceInterface(ctx, model.ActionRead, obj, accountRef); err == nil {
+			allowedObjects = append(allowedObjects, obj)
+		} else if !errors.Is(err, merrors.ErrAccessDenied) {
+			// If the error is something other than AccessDenied, we want to fail
+			db.Logger.Warn("Error while enforcing read permission", zap.Error(err), mzap.ObjRef("object_ref", *obj.GetID()))
+			return nil, err
+		}
+		// If AccessDenied, we simply skip that object
+	}
+
+	db.Logger.Debug("Successfully filtered account bound objects", zap.Int("total_count", len(allObjects)),
+		zap.Int("allowed_count", len(allowedObjects)), mzap.ObjRef("account_ref", accountRef))
+	return allowedObjects, nil
+}
+
+func (db *AccountBoundDBImp[T]) GetByAccountRef(ctx context.Context, accountRef primitive.ObjectID, result T) error {
+	db.Logger.Debug("Attempting to get object by account ref", mzap.ObjRef("account_ref", accountRef))
+
+	// Build query to find objects where accountRef matches OR is null/absent
+	query := repository.WithoutOrg(accountRef)
+
+	if err := db.DBImp.FindOne(ctx, query, result); err != nil {
+		db.Logger.Warn("Failed to get object by account ref", zap.Error(err), mzap.ObjRef("account_ref", accountRef))
+		return err
+	}
+
+	// Check organization read permission for the found object
+	if err := db.enforce(ctx, model.ActionRead, result, accountRef); err != nil {
+		return err
+	}
+
+	db.Logger.Debug("Successfully retrieved object by account ref", mzap.ObjRef("account_ref", accountRef),
+		mzap.ObjRef("organization_ref", result.GetOrganizationRef()))
+	return nil
+}
+
+func (db *AccountBoundDBImp[T]) DeleteByAccountRef(ctx context.Context, accountRef primitive.ObjectID) error {
+	db.Logger.Debug("Attempting to delete objects by account ref", mzap.ObjRef("account_ref", accountRef))
+
+	// Build query to find objects where accountRef matches OR is null/absent
+	query := repository.WithoutOrg(accountRef)
+
+	// Get all candidate objects for individual permission checking
+	allObjects, err := db.DBImp.Repository.ListAccountBound(ctx, query)
+	if err != nil {
+		db.Logger.Warn("Failed to list objects for delete by account ref", zap.Error(err), mzap.ObjRef("account_ref", accountRef))
+		return err
+	}
+
+	// Check permissions for each object individually (AccountBoundStorable doesn't have permission info)
+	var allowedIDs []primitive.ObjectID
+	for _, obj := range allObjects {
+		if err := db.enforceInterface(ctx, model.ActionUpdate, obj, accountRef); err == nil {
+			allowedIDs = append(allowedIDs, *obj.GetID())
+		} else if !errors.Is(err, merrors.ErrAccessDenied) {
+			// If the error is something other than AccessDenied, we want to fail
+			db.Logger.Warn("Error while enforcing update permission", zap.Error(err), mzap.ObjRef("object_ref", *obj.GetID()))
+			return err
+		}
+		// If AccessDenied, we simply skip that object
+	}
+
+	if len(allowedIDs) == 0 {
+		db.Logger.Debug("No objects allowed for deletion by account ref", mzap.ObjRef("account_ref", accountRef))
+		return nil
+	}
+
+	// Delete only the allowed objects
+	allowedQuery := query.And(repository.Query().In(repository.IDField(), allowedIDs))
+	if err := db.DBImp.DeleteMany(ctx, allowedQuery); err != nil {
+		db.Logger.Warn("Failed to delete objects by account ref", zap.Error(err), mzap.ObjRef("account_ref", accountRef))
+		return err
+	}
+
+	db.Logger.Debug("Successfully deleted objects by account ref", mzap.ObjRef("account_ref", accountRef), zap.Int("count", len(allowedIDs)))
+	return nil
+}
+
+func (db *AccountBoundDBImp[T]) DeleteCascade(ctx context.Context, objectRef primitive.ObjectID) error {
+	return db.DBImp.DeleteCascade(ctx, objectRef)
+}
+
+// CreateAccountBoundImp creates a concrete AccountBoundDBImp instance for internal use
+func CreateAccountBoundImp[T model.AccountBoundStorable](
+	ctx context.Context,
+	logger mlogger.Logger,
+	pdb policy.DB,
+	enforcer Enforcer,
+	collection mservice.Type,
+	db *mongo.Database,
+) (*AccountBoundDBImp[T], error) {
+	logger = logger.Named("account_bound")
+	var policy model.PolicyDescription
+	if err := pdb.GetBuiltInPolicy(ctx, mservice.Organizations, &policy); err != nil {
+		logger.Warn("Failed to fetch organization policy description", zap.Error(err))
+		return nil, err
+	}
+	res := &AccountBoundDBImp[T]{
+		Logger:        logger,
+		DBImp:         template.Create[T](logger, collection, db),
+		Enforcer:      enforcer,
+		PermissionRef: policy.ID,
+		Collection:    collection,
+	}
+	return res, nil
+}